@cosmicdrift/kumiko-bundled-features 0.352.0 → 0.354.0

package/dist/folders/handlers/delete-folder.write.js

@@ -1,5 +1,6 @@
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { hostRowIsGone } from "../../shared/index.js";
 import { DEFAULT_FOLDER_ACCESS } from "../constants.js";
 import { folderAssignmentExecutor, folderExecutor } from "../executor.js";
 const deleteFolderPayloadSchema = z.object({ id: z.uuid() });
@@ -10,18 +11,44 @@ const deleteFolderPayloadSchema = z.object({ id: z.uuid() });
 // see 658/1). Block server-side instead: this is the same "referential
 // integrity has no FK here" reasoning set-folder.write.ts already applies to
 // folderId on assignment-creation.
+//
+// Assignments whose host is gone (hard-deleted, soft-deleted or unregistered)
+// are cleaned up here instead of blocking forever: clear-folder can't reach
+// them (it requires a visible host). A host-delete hook would break restore,
+// so the cleanup runs lazily at folder:delete.
+const ASSIGNMENT_PAGE_SIZE = 200;
 export function createDeleteFolderHandler(access = DEFAULT_FOLDER_ACCESS) {
     return {
         name: "folder:delete",
         schema: deleteFolderPayloadSchema,
         access,
-        description: "Deletes a folder from the tenant catalog and refuses while any entity is still filed in it; use it once that folder's contents have been unfiled or moved elsewhere.",
+        description: "Deletes a folder from the tenant catalog and refuses while any live entity is still filed in it (assignments of deleted hosts are cleaned up); use it once that folder's contents have been unfiled or moved elsewhere.",
         agent: { risk: "high" },
         handler: async (event, ctx) => {
             const payload = event.payload; // @cast-boundary engine-payload
-            const assigned = await folderAssignmentExecutor.list({ filter: { field: "folderId", op: "eq", value: payload.id }, limit: 1 }, event.user, ctx.db);
-            if (assigned.rows.length > 0) {
-                return writeFailure(new UnprocessableError("folder_has_assignments", { details: { folderId: payload.id } }));
+            const orphanAssignmentIds = [];
+            let cursor;
+            do {
+                const page = await folderAssignmentExecutor.list({
+                    filter: { field: "folderId", op: "eq", value: payload.id },
+                    limit: ASSIGNMENT_PAGE_SIZE,
+                    cursor,
+                }, event.user, ctx.db);
+                for (const row of page.rows) {
+                    const gone = await hostRowIsGone(ctx.registry, String(row["entityType"]), String(row["entityId"]), ctx.db);
+                    if (!gone) {
+                        return writeFailure(new UnprocessableError("folder_has_assignments", {
+                            details: { folderId: payload.id },
+                        }));
+                    }
+                    orphanAssignmentIds.push(String(row["id"]));
+                }
+                cursor = page.nextCursor ?? undefined;
+            } while (cursor !== undefined);
+            for (const id of orphanAssignmentIds) {
+                const removed = await folderAssignmentExecutor.delete({ id }, event.user, ctx.db);
+                if (!removed.isSuccess)
+                    return removed;
             }
             return folderExecutor.delete({ id: payload.id }, event.user, ctx.db);
         },

package/dist/form-draft/db/queries/cleanup.d.ts

@@ -12,4 +12,4 @@ export type StaleDraftRow = {
 };
 export declare function selectStaleDraftsBatch(db: DbConnection, olderThanDays: number, batchSize: number): Promise<readonly StaleDraftRow[]>;
 /** Re-check staleness after the select→release window so a freshly saved draft is not deleted. */
-export declare function isDraftStillStale(db: DbConnection, id: string, olderThanDays: number): Promise<boolean>;
+export declare function isDraftStillStale(db: DbConnection, tenantId: TenantId, id: string, olderThanDays: number): Promise<boolean>;

package/dist/form-draft/db/queries/cleanup.js

@@ -26,10 +26,11 @@ export async function selectStaleDraftsBatch(db, olderThanDays, batchSize) {
     }));
 }
 /** Re-check staleness after the select→release window so a freshly saved draft is not deleted. */
-export async function isDraftStillStale(db, id, olderThanDays) {
+export async function isDraftStillStale(db, tenantId, id, olderThanDays) {
     const rows = (await unsafeReadRetrying(db, `SELECT 1 FROM "read_form_drafts"
      WHERE "id" = $1
-       AND COALESCE("modified_at", "inserted_at") < now() - ($2::int * interval '1 day')
-     LIMIT 1`, [id, olderThanDays]));
+       AND "tenant_id" = $2
+       AND COALESCE("modified_at", "inserted_at") < now() - ($3::int * interval '1 day')
+     LIMIT 1`, [id, tenantId, olderThanDays]));
     return rows.length > 0;
 }

package/dist/form-draft/entity.d.ts

@@ -3,6 +3,7 @@ export declare const formDraftEntity: import("@cosmicdrift/kumiko-types/fields")
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -24,6 +25,7 @@ export declare const formDraftEntity: import("@cosmicdrift/kumiko-types/fields")
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/form-draft/handlers/cleanup.job.d.ts

@@ -1,8 +1,12 @@
 import { type DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import { type ConfigKeyDefinition, type JobContext, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { type AppContext, type ConfigKeyDefinition, type JobContext, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { type StaleDraftRow } from "../db/queries/cleanup.js";
 export declare const FORM_DRAFT_RETENTION_DAYS_CONFIG_KEY = "form-draft:config:retention-days";
 export declare const FORM_DRAFT_DEFAULT_RETENTION_DAYS = 30;
 export declare const formDraftRetentionDaysConfig: ConfigKeyDefinition<"number">;
 export declare function groupStaleDraftIdsByTenant(batch: readonly StaleDraftRow[]): ReadonlyMap<TenantId, readonly string[]>;
+export declare function deleteStaleDraftsBatch(batch: readonly StaleDraftRow[], db: DbConnection, retentionDays: number, log: AppContext["log"]): Promise<{
+    readonly deletedRows: readonly StaleDraftRow[];
+    readonly skippedCount: number;
+}>;
 export declare function cleanupDraftsJob(_payload: Record<string, unknown>, ctx: JobContext, db: DbConnection): Promise<void>;

package/dist/form-draft/handlers/cleanup.job.js

@@ -72,16 +72,19 @@ export function groupStaleDraftIdsByTenant(batch) {
 // resurrects, PII included. formDraftExecutor.delete() is the event-sourced
 // path; it needs a tenant-scoped db + a SessionUser, so rows are grouped by
 // tenant first (see groupStaleDraftIdsByTenant above).
-async function deleteStaleDraftsBatch(batch, db, retentionDays, log) {
+export async function deleteStaleDraftsBatch(batch, db, retentionDays, log) {
     const deletedRows = [];
+    let skippedCount = 0;
     const byId = new Map(batch.map((row) => [row.id, row]));
     for (const [tenantId, ids] of groupStaleDraftIdsByTenant(batch)) {
         const systemUser = createSystemUser(tenantId);
         const tenantDb = createTenantDb(db, tenantId, "system");
         for (const id of ids) {
             // Race: user may have saved between select and here — skip if no longer stale.
-            if (!(await isDraftStillStale(db, id, retentionDays)))
+            if (!(await isDraftStillStale(db, tenantId, id, retentionDays))) {
+                skippedCount++;
                 continue;
+            }
             const result = await formDraftExecutor.delete({ id }, systemUser, tenantDb);
             if (result.isSuccess) {
                 const row = byId.get(id);
@@ -93,7 +96,7 @@ async function deleteStaleDraftsBatch(batch, db, retentionDays, log) {
             }
         }
     }
-    return deletedRows;
+    return { deletedRows, skippedCount };
 }
 export async function cleanupDraftsJob(_payload, ctx, db) {
     const resolved = ctx.configResolver
@@ -122,12 +125,15 @@ export async function cleanupDraftsJob(_payload, ctx, db) {
         // entirely for rows with no FileRefs in the blob, the common case.
         // Delete first (with staleness re-check), then release binaries from rows
         // that actually disappeared — never release a draft the user just saved.
-        const deletedRows = await deleteStaleDraftsBatch(batch, db, retentionDays, ctx.log);
+        const { deletedRows, skippedCount } = await deleteStaleDraftsBatch(batch, db, retentionDays, ctx.log);
         for (const row of deletedRows) {
             await releaseRowFileRefs(row, db, fileProviderResolver, ctx.log);
         }
         deleted += deletedRows.length;
-        if (deletedRows.length === 0 || batch.length < DEFAULT_BATCH_SIZE)
+        // A skipped row is no longer stale, so the next select drops it — a fully
+        // skipped batch still makes progress. Only a batch with neither deletes nor
+        // skips (all failed) would reselect the same rows forever.
+        if (deletedRows.length + skippedCount === 0 || batch.length < DEFAULT_BATCH_SIZE)
             break;
     }
     ctx.log?.info?.(`[form-draft:cleanup] deleted=${deleted} retentionDays=${retentionDays}`);

package/dist/foundation-shared/index.d.ts

@@ -1,3 +1,3 @@
 export { requireDefined, requireNonEmpty, requireSecretSet } from "./config-helpers.js";
 export { isHostAllowlisted, readHostAllowlistFromEnv } from "./host-allowlist.js";
-export { BlockedHostError, HostResolutionError, MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR, type MailConnectTarget, type MailHostGuardOptions, readAllowedPrivateMailHostsFromEnv, resolveMailConnectTarget, } from "./mail-host-policy.js";
+export { BlockedHostError, HostResolutionError, MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR, type MailConnectTarget, type MailHostGuardOptions, mailAllowedPrivateHostsEnvSchema, readAllowedPrivateMailHostsFromEnv, resolveMailConnectTarget, } from "./mail-host-policy.js";

package/dist/foundation-shared/index.js

@@ -2,4 +2,4 @@
 // Foundation packages (ai-foundation, mail-foundation, file-foundation).
 export { requireDefined, requireNonEmpty, requireSecretSet } from "./config-helpers.js";
 export { isHostAllowlisted, readHostAllowlistFromEnv } from "./host-allowlist.js";
-export { BlockedHostError, HostResolutionError, MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR, readAllowedPrivateMailHostsFromEnv, resolveMailConnectTarget, } from "./mail-host-policy.js";
+export { BlockedHostError, HostResolutionError, MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR, mailAllowedPrivateHostsEnvSchema, readAllowedPrivateMailHostsFromEnv, resolveMailConnectTarget, } from "./mail-host-policy.js";

package/dist/foundation-shared/mail-host-policy.d.ts

@@ -1,5 +1,9 @@
 import type { lookup } from "node:dns/promises";
+import * as z from "zod";
 export declare const MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR = "KUMIKO_MAIL_ALLOWED_PRIVATE_HOSTS";
+export declare const mailAllowedPrivateHostsEnvSchema: z.ZodObject<{
+    KUMIKO_MAIL_ALLOWED_PRIVATE_HOSTS: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
 export declare function readAllowedPrivateMailHostsFromEnv(env?: Readonly<Record<string, string | undefined>>): readonly string[];
 export type MailHostGuardOptions = {
     readonly allowedPrivateMailHosts?: readonly string[];

package/dist/foundation-shared/mail-host-policy.js

@@ -10,14 +10,23 @@
 // internal relay or a dev/test server (mailpit, greenmail) — deliberately
 // an operator env var (KUMIKO_MAIL_ALLOWED_PRIVATE_HOSTS, read via
 // readAllowedPrivateMailHostsFromEnv), never a tenant-config key, so a
-// tenant can never grant themselves the bypass. Shared by both features
-// since a deploy commonly mounts both; declared once in mail-transport-
-// smtp's envSchema (see its feature.ts) to avoid the framework's env-var-
-// conflict check tripping when both features are mounted together.
+// tenant can never grant themselves the bypass. Both features register the
+// shared mailAllowedPrivateHostsEnvSchema below.
 import { isIP } from "node:net";
 import { resolvePublicHostname } from "@cosmicdrift/kumiko-framework/http";
+import * as z from "zod";
 import { isHostAllowlisted, readHostAllowlistFromEnv } from "./host-allowlist.js";
 export const MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR = "KUMIKO_MAIL_ALLOWED_PRIVATE_HOSTS";
+// One schema instance, registered by every feature that reads the variable:
+// composeEnvSchema accepts the same field instance from several features, so
+// an app mounting only one of them still gets the variable validated and
+// documented.
+export const mailAllowedPrivateHostsEnvSchema = z.object({
+    [MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR]: z
+        .string()
+        .optional()
+        .describe("Comma-separated operator allowlist of private/internal hosts (e.g. a local mailpit/greenmail dev server) that bypass the public-address check for SMTP and IMAP host config. Shared by mail-transport-smtp and inbound-provider-imap — never a tenant-config value."),
+});
 export function readAllowedPrivateMailHostsFromEnv(env = process.env) {
     return readHostAllowlistFromEnv(MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR, env);
 }

package/dist/inbound-mail-foundation/entities.d.ts

@@ -5,6 +5,7 @@ export declare const mailAccountEntity: import("@cosmicdrift/kumiko-types/fields
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -26,6 +27,7 @@ export declare const mailAccountEntity: import("@cosmicdrift/kumiko-types/fields
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -47,6 +49,7 @@ export declare const mailAccountEntity: import("@cosmicdrift/kumiko-types/fields
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -68,6 +71,7 @@ export declare const mailAccountEntity: import("@cosmicdrift/kumiko-types/fields
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -89,6 +93,7 @@ export declare const mailAccountEntity: import("@cosmicdrift/kumiko-types/fields
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -110,6 +115,7 @@ export declare const mailAccountEntity: import("@cosmicdrift/kumiko-types/fields
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -131,6 +137,7 @@ export declare const mailAccountEntity: import("@cosmicdrift/kumiko-types/fields
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -172,6 +179,7 @@ export declare const inboundMessageEntity: import("@cosmicdrift/kumiko-types/fie
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -193,6 +201,7 @@ export declare const inboundMessageEntity: import("@cosmicdrift/kumiko-types/fie
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -214,6 +223,7 @@ export declare const inboundMessageEntity: import("@cosmicdrift/kumiko-types/fie
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -235,6 +245,7 @@ export declare const inboundMessageEntity: import("@cosmicdrift/kumiko-types/fie
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -256,6 +267,7 @@ export declare const inboundMessageEntity: import("@cosmicdrift/kumiko-types/fie
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -277,6 +289,7 @@ export declare const inboundMessageEntity: import("@cosmicdrift/kumiko-types/fie
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -298,6 +311,7 @@ export declare const inboundMessageEntity: import("@cosmicdrift/kumiko-types/fie
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -319,6 +333,7 @@ export declare const inboundMessageEntity: import("@cosmicdrift/kumiko-types/fie
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -340,6 +355,7 @@ export declare const inboundMessageEntity: import("@cosmicdrift/kumiko-types/fie
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -376,6 +392,7 @@ export declare const inboundMessageEntity: import("@cosmicdrift/kumiko-types/fie
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -397,6 +414,7 @@ export declare const inboundMessageEntity: import("@cosmicdrift/kumiko-types/fie
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -422,6 +440,7 @@ export declare const mailThreadEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -443,6 +462,7 @@ export declare const mailThreadEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -507,6 +527,7 @@ export declare const syncCursorEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -528,6 +549,7 @@ export declare const syncCursorEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -549,6 +571,7 @@ export declare const syncCursorEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -591,6 +614,7 @@ export declare const seenMessageEntity: import("@cosmicdrift/kumiko-types/fields
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -612,6 +636,7 @@ export declare const seenMessageEntity: import("@cosmicdrift/kumiko-types/fields
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/inbound-mail-foundation/projection.d.ts

@@ -3,6 +3,7 @@ export declare const mailAccountsProjectionTable: import("@cosmicdrift/kumiko-fr
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -24,6 +25,7 @@ export declare const mailAccountsProjectionTable: import("@cosmicdrift/kumiko-fr
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -45,6 +47,7 @@ export declare const mailAccountsProjectionTable: import("@cosmicdrift/kumiko-fr
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -66,6 +69,7 @@ export declare const mailAccountsProjectionTable: import("@cosmicdrift/kumiko-fr
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -87,6 +91,7 @@ export declare const mailAccountsProjectionTable: import("@cosmicdrift/kumiko-fr
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -108,6 +113,7 @@ export declare const mailAccountsProjectionTable: import("@cosmicdrift/kumiko-fr
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -129,6 +135,7 @@ export declare const mailAccountsProjectionTable: import("@cosmicdrift/kumiko-fr
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -167,6 +174,7 @@ export declare const inboundMessagesProjectionTable: import("@cosmicdrift/kumiko
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -188,6 +196,7 @@ export declare const inboundMessagesProjectionTable: import("@cosmicdrift/kumiko
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -209,6 +218,7 @@ export declare const inboundMessagesProjectionTable: import("@cosmicdrift/kumiko
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -230,6 +240,7 @@ export declare const inboundMessagesProjectionTable: import("@cosmicdrift/kumiko
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -251,6 +262,7 @@ export declare const inboundMessagesProjectionTable: import("@cosmicdrift/kumiko
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -272,6 +284,7 @@ export declare const inboundMessagesProjectionTable: import("@cosmicdrift/kumiko
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -293,6 +306,7 @@ export declare const inboundMessagesProjectionTable: import("@cosmicdrift/kumiko
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -314,6 +328,7 @@ export declare const inboundMessagesProjectionTable: import("@cosmicdrift/kumiko
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -335,6 +350,7 @@ export declare const inboundMessagesProjectionTable: import("@cosmicdrift/kumiko
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -371,6 +387,7 @@ export declare const inboundMessagesProjectionTable: import("@cosmicdrift/kumiko
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -392,6 +409,7 @@ export declare const inboundMessagesProjectionTable: import("@cosmicdrift/kumiko
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -415,6 +433,7 @@ export declare const mailThreadsProjectionTable: import("@cosmicdrift/kumiko-fra
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -436,6 +455,7 @@ export declare const mailThreadsProjectionTable: import("@cosmicdrift/kumiko-fra
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/inbound-provider-imap/feature.js

@@ -22,6 +22,7 @@
 // Credentials: JSON-Dokument im per-Account-Secret-Slot
 // (credential-document.ts) — kein Tenant-Config, weil mehrere Accounts
 // pro Tenant verschiedene Hosts haben.
+import { mailAllowedPrivateHostsEnvSchema } from "@cosmicdrift/kumiko-bundled-features/foundation-shared";
 import { INBOUND_MAIL_PROVIDER_EXTENSION, InboundAuthError, inboundCredentialSecretKey, } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
 import { requireSecretsContext } from "@cosmicdrift/kumiko-bundled-features/secrets";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
@@ -225,5 +226,6 @@ export const inboundProviderImapFeature = defineFeature(FEATURE_NAME, (r) => {
     });
     r.requires("inbound-mail-foundation");
     r.requires("secrets");
+    r.envSchema(mailAllowedPrivateHostsEnvSchema);
     r.useExtension(INBOUND_MAIL_PROVIDER_EXTENSION, IMAP_PROVIDER_KEY, imapInboundMailPlugin);
 });

package/dist/inbound-provider-imap/imap-client.js

@@ -21,10 +21,9 @@ const IMAP_HOST_UNREACHABLE_MESSAGE = "IMAP host is not reachable or not allowed
 // =============================================================================
 // Operator escape hatch for an internal relay or a dev/test IMAP server
 // (greenmail): KUMIKO_MAIL_ALLOWED_PRIVATE_HOSTS, the same operator env
-// var mail-transport-smtp declares (see its envSchema — composeEnvSchema
-// rejects two features declaring the same key, so this feature reads it
-// without redeclaring it), never a tenant-config value, so a tenant can
-// never grant themselves the private-host bypass.
+// var mail-transport-smtp registers (both share one schema instance, see
+// foundation-shared), never a tenant-config value, so a tenant can never
+// grant themselves the private-host bypass.
 //
 // mailHostLookup is a test-only DNS seam — production leaves it undefined,
 // so resolveMailConnectTarget uses the real resolver. Module-global state:

package/dist/jobs/constants.d.ts

@@ -8,6 +8,7 @@ export declare const JobQueries: {
     readonly details: "jobs:query:details";
     readonly catalog: "jobs:query:catalog";
     readonly failures: "jobs:query:failures";
+    readonly tenantRuns: "jobs:query:tenant-runs";
 };
 export declare const JobErrors: {
     readonly unknownJob: "unknown_job";

package/dist/jobs/constants.js

@@ -12,6 +12,7 @@ export const JobQueries = {
     details: "jobs:query:details",
     catalog: "jobs:query:catalog",
     failures: "jobs:query:failures",
+    tenantRuns: "jobs:query:tenant-runs",
 };
 // Error codes
 export const JobErrors = {

package/dist/jobs/db/queries/retention.d.ts

@@ -3,5 +3,6 @@ export type JobRunRetentionResult = {
     readonly runsDeleted: number;
     readonly logsDeleted: number;
     readonly tenantFailuresDeleted: number;
+    readonly tenantRunsDeleted: number;
 };
 export declare function deleteStaleJobRuns(db: DbConnection, retentionDays: number): Promise<JobRunRetentionResult>;

package/dist/jobs/db/queries/retention.js

@@ -12,6 +12,7 @@
 import { deleteManyBatched } from "@cosmicdrift/kumiko-framework/bun-db";
 import { jobRunLogsTable, jobRunsTable } from "../../job-run-table.js";
 import { tenantJobFailuresTable } from "../../tenant-job-failure-table.js";
+import { tenantJobRunsTable } from "../../tenant-job-run-table.js";
 const RETENTION_DELETE_BATCH_SIZE = 500;
 export async function deleteStaleJobRuns(db, retentionDays) {
     const cutoff = Temporal.Now.instant().subtract({ hours: retentionDays * 24 });
@@ -21,9 +22,13 @@ export async function deleteStaleJobRuns(db, retentionDays) {
     // they point at is gone by now, and a job whose subject never ran again
     // would otherwise keep its record forever.
     const tenantFailuresResult = await deleteManyBatched(db, tenantJobFailuresTable, { failedAt: { lt: cutoff } }, { limit: RETENTION_DELETE_BATCH_SIZE });
+    // Only finished rows: active ones are the stale sweep's business, and a
+    // still-running job older than the window must not vanish from the tenant.
+    const tenantRunsResult = await deleteManyBatched(db, tenantJobRunsTable, { status: { in: ["completed", "failed"] }, updatedAt: { lt: cutoff } }, { limit: RETENTION_DELETE_BATCH_SIZE });
     return {
         runsDeleted: runsResult.deleted,
         logsDeleted: logsResult.deleted,
         tenantFailuresDeleted: tenantFailuresResult.deleted,
+        tenantRunsDeleted: tenantRunsResult.deleted,
     };
 }

package/dist/jobs/db/queries/stale-run-sweep.d.ts

@@ -2,5 +2,7 @@ import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 export declare const STALE_JOB_RUN_ERROR = "job run exceeded the stale-run timeout without a completion signal (likely a crashed worker process)";
 export type StaleRunSweepResult = {
     readonly runsMarkedFailed: number;
+    readonly tenantRunsMarkedFailed: number;
+    readonly tenantQueuedDropped: number;
 };
 export declare function markStaleJobRunsFailed(db: DbConnection, timeoutHours: number): Promise<StaleRunSweepResult>;