@cosmicdrift/kumiko-bundled-features 0.362.0 → 0.364.0

package/dist/document-ingest-foundation/pages.js

@@ -3,6 +3,7 @@
 // JSON.stringify(IngestPage[]) and readers must parse back. Centralising
 // the codec here keeps liteparse + recipe consumers lockstep with the
 // entity shape (kumiko-framework#1549/1).
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 export function writeIngestPages(pages) {
     return JSON.stringify(pages);
 }
@@ -25,8 +26,7 @@ function parseJson(raw) {
     }
 }
 function isIngestPage(value) {
-    if (value === null || typeof value !== "object")
-        return false;
-    const page = value;
-    return typeof page.pageNumber === "number" && typeof page.text === "string";
+    return (isPlainObject(value) &&
+        typeof value["pageNumber"] === "number" &&
+        typeof value["text"] === "string");
 }

package/dist/feature-toggles/handlers/set.write.d.ts

@@ -7,4 +7,4 @@ export declare function createSetWriteHandler(getRuntime: (() => GlobalFeatureTo
     featureName: string;
     enabled: boolean;
     previousEnabled: boolean | null;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/feature-toggles/toggle-sync-signal.js

@@ -1,12 +1,12 @@
 import { CACHE_SYNC_TOPICS, createRedisPubSubSignal, redisChannelPrefixFromEnv, } from "@cosmicdrift/kumiko-framework/redis";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 // Single fixed channel — unlike the SSE broker there's no per-tenant/
 // per-user variance to multiplex, every toggle flip is global.
 const TOGGLE_SYNC_CHANNEL_NAME = "kumiko:feature-toggles:cache-sync";
 function isTogglePayload(value) {
-    return (typeof value === "object" &&
-        value !== null &&
-        typeof value.featureName === "string" &&
-        typeof value.enabled === "boolean");
+    return (isPlainObject(value) &&
+        typeof value["featureName"] === "string" &&
+        typeof value["enabled"] === "boolean");
 }
 // fw#2625: gives toggle-cache-sync the cross-replica transport its shared
 // dispatcher cursor needs — without this, only the one process that won

package/dist/file-derivatives/handlers/public-variant.query.js

@@ -99,7 +99,7 @@ export const publicVariantQuery = defineQueryHandler({
         if (!spec)
             return null;
         const result = await derivatives.variant(query.payload.fileRefId, spec, query.payload.variant);
-        const bytes = await files.ref(result.storageKey).read();
+        const bytes = await files.refFromFileRef(result).read();
         // ponytail: fully buffered (no streaming), +33% over the wire from
         // base64 — HttpRouteHandlerDeps only exposes {app, systemQuery} (no
         // direct ctx.files access from the Hono handler itself), and the local

package/dist/file-foundation/index.d.ts

@@ -1 +1,2 @@
 export { createFileProviderForTenant, type FileProviderContext, type FileProviderPlugin, fileFoundationFeature, isFileProviderPlugin, } from "./feature.js";
+export { type FileRefContent, FileRefTooLargeError, fileContextForTenant, fileContextFromResolver, readFileRefContent, } from "./read-file-ref-content.js";

package/dist/file-foundation/index.js

@@ -1,2 +1,3 @@
 // Public API of the file-foundation bundled-feature.
 export { createFileProviderForTenant, fileFoundationFeature, isFileProviderPlugin, } from "./feature.js";
+export { FileRefTooLargeError, fileContextForTenant, fileContextFromResolver, readFileRefContent, } from "./read-file-ref-content.js";

package/dist/file-foundation/read-file-ref-content.d.ts

@@ -0,0 +1,27 @@
+import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { type FileContext, type FileProviderResolver } from "@cosmicdrift/kumiko-framework/files";
+export type FileRefContent = {
+    readonly content: Uint8Array;
+    readonly contentType: string;
+    readonly tenantId: string;
+    readonly size: number;
+};
+export declare function fileContextForTenant(ctx: {
+    readonly _fileProviderResolver?: FileProviderResolver | undefined;
+    readonly files?: FileContext | undefined;
+}, contextTenantId: string, tenantId: string): FileContext | undefined;
+export declare function fileContextFromResolver(resolver: FileProviderResolver, tenantId: string): FileContext;
+export declare class FileRefTooLargeError extends Error {
+    readonly size: number;
+    constructor(size: number);
+}
+export declare function readFileRefContent(args: {
+    readonly db: DbRunner | TenantDb;
+    readonly filesForTenant: (tenantId: string) => FileContext | undefined;
+    readonly fileRefId: string;
+    readonly allowedTenantIds: readonly string[];
+    /** Only accept this user's own upload that is not bound to any entity yet. */
+    readonly unclaimedUploadOf?: string;
+    /** Rejects before any bytes are read when the stored size exceeds the limit. */
+    readonly maxBytes?: number;
+}): Promise<FileRefContent | null>;

package/dist/file-foundation/read-file-ref-content.js

@@ -0,0 +1,51 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { isUuid } from "@cosmicdrift/kumiko-framework/engine";
+import { createFileContext, fileRefsTable, } from "@cosmicdrift/kumiko-framework/files";
+// Tenant-bound on purpose: without a resolver `ctx.files` only reaches the storage of the
+// context's own tenant (`contextTenantId`), so a request for another tenant's files is
+// undefined instead of silently reading through the wrong tenant's storage.
+export function fileContextForTenant(ctx, contextTenantId, tenantId) {
+    const resolver = ctx._fileProviderResolver;
+    if (resolver === undefined)
+        return tenantId === contextTenantId ? ctx.files : undefined;
+    return fileContextFromResolver(resolver, tenantId);
+}
+export function fileContextFromResolver(resolver, tenantId) {
+    // @cast-boundary engine-payload — tenantId comes from a trusted job payload or session
+    const brandedTenantId = tenantId;
+    return createFileContext(() => resolver(brandedTenantId), tenantId);
+}
+export class FileRefTooLargeError extends Error {
+    size;
+    constructor(size) {
+        super(`file ref exceeds the size limit (${size} bytes)`);
+        this.size = size;
+    }
+}
+// fileName of the row is never used: it is personal data and may be a PII ciphertext.
+export async function readFileRefContent(args) {
+    if (!isUuid(args.fileRefId))
+        return null;
+    const [row] = await selectMany(args.db, fileRefsTable, {
+        id: args.fileRefId,
+        tenantId: { in: args.allowedTenantIds },
+        isDeleted: false,
+        ...(args.unclaimedUploadOf !== undefined && {
+            insertedById: args.unclaimedUploadOf,
+            entityType: null,
+            entityId: null,
+        }),
+    });
+    if (row === undefined)
+        return null;
+    const size = Number(row.size);
+    if (args.maxBytes !== undefined && size > args.maxBytes) {
+        throw new FileRefTooLargeError(size);
+    }
+    const files = args.filesForTenant(row.tenantId);
+    if (files === undefined) {
+        throw new Error("readFileRefContent: no file storage is available for the file's tenant");
+    }
+    const content = await files.refFromFileRef(row).read();
+    return { content, contentType: row.mimeType, tenantId: row.tenantId, size };
+}

package/dist/files-tenant-data/hooks.js

@@ -97,6 +97,7 @@ export const fileRefTenantDestroyHook = async (ctx) => {
         },
         maxFailures: 1,
         deadlineAt: ctx.deadlineAt ?? Number.POSITIVE_INFINITY,
+        minBatches: 1,
         onRowError: (_row, err) => {
             firstFailure = err instanceof Error ? err.message : String(err);
         },
@@ -176,6 +177,9 @@ export const fileRefStorageDestroyHook = async (tenantId, ctx) => {
             },
             maxFailures: 1,
             deadlineAt: ctx.deadlineAt ?? Number.POSITIVE_INFINITY,
+            // list() and the survivor lookup above can use up the whole budget; one chunk per tick
+            // still deletes, so the stage never reports "no progress".
+            minBatches: 1,
             onRowError: (_key, err) => {
                 firstFailure = err instanceof Error ? err.message : String(err);
             },

package/dist/folders/web/folder-manager.js

@@ -42,7 +42,8 @@ const loadCollapsed = () => {
         return new Set();
     try {
         const raw = window.localStorage.getItem(COLLAPSED_KEY);
-        return new Set(raw ? JSON.parse(raw) : []);
+        const parsed = raw ? JSON.parse(raw) : [];
+        return new Set(Array.isArray(parsed) ? parsed.filter((id) => typeof id === "string") : []);
     }
     catch {
         return new Set();
@@ -207,7 +208,7 @@ export function FolderManager({ renderMeta, filing, }) {
                 setDragOverKey(key);
             },
             onDragLeave: (e) => {
-                if (!e.currentTarget.contains(e.relatedTarget))
+                if (!(e.relatedTarget instanceof Node && e.currentTarget.contains(e.relatedTarget)))
                     setDragOverKey((cur) => (cur === key ? null : cur));
             },
             onDrop: (e) => {

package/dist/form-draft/db/queries/cleanup.js

@@ -12,10 +12,10 @@ import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 // rebuild must not resurrect a "deleted" draft). Ordered oldest-first so a
 // batch is a stable, deterministic slice across the two queries.
 export async function selectStaleDraftsBatch(db, olderThanDays, batchSize) {
-    const rows = (await unsafeReadRetrying(db, `SELECT "id", "tenant_id", "owner_id", "draft_key", "draft", "inserted_at" FROM "read_form_drafts"
+    const rows = await unsafeReadRetrying(db, `SELECT "id", "tenant_id", "owner_id", "draft_key", "draft", "inserted_at" FROM "read_form_drafts"
      WHERE COALESCE("modified_at", "inserted_at") < now() - ($1::int * interval '1 day')
      ORDER BY COALESCE("modified_at", "inserted_at") ASC
-     LIMIT $2`, [olderThanDays, batchSize]));
+     LIMIT $2`, [olderThanDays, batchSize]);
     return rows.map((row) => ({
         id: row.id,
         tenantId: row.tenant_id, // @cast-boundary db-row
@@ -27,10 +27,10 @@ export async function selectStaleDraftsBatch(db, olderThanDays, batchSize) {
 }
 /** Re-check staleness after the select→release window so a freshly saved draft is not deleted. */
 export async function isDraftStillStale(db, tenantId, id, olderThanDays) {
-    const rows = (await unsafeReadRetrying(db, `SELECT 1 FROM "read_form_drafts"
+    const rows = await unsafeReadRetrying(db, `SELECT 1 FROM "read_form_drafts"
      WHERE "id" = $1
        AND "tenant_id" = $2
        AND COALESCE("modified_at", "inserted_at") < now() - ($3::int * interval '1 day')
-     LIMIT 1`, [id, tenantId, olderThanDays]));
+     LIMIT 1`, [id, tenantId, olderThanDays]);
     return rows.length > 0;
 }

package/dist/form-draft/db/queries/draft-count.js

@@ -4,7 +4,7 @@ import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
 // (64KB); loading up to FORM_DRAFT_MAX_PER_OWNER full rows just to count them
 // would be several MB of wasted transfer per save.
 export async function countDraftsByOwner(db, tenantId, ownerId) {
-    const rows = (await unsafeReadRetrying(db, `SELECT count(*)::int AS "count" FROM "read_form_drafts"
-     WHERE "tenant_id" = $1 AND "owner_id" = $2`, [tenantId, ownerId]));
+    const rows = await unsafeReadRetrying(db, `SELECT count(*)::int AS "count" FROM "read_form_drafts"
+     WHERE "tenant_id" = $1 AND "owner_id" = $2`, [tenantId, ownerId]);
     return rows[0]?.count ?? 0;
 }

package/dist/form-draft/db/queries/owned-file-refs.js

@@ -29,9 +29,9 @@ export async function filterOwnedStorageKeys(db, tenantId, ownerId, candidateKey
 export async function filterOwnedFileRefs(db, tenantId, ownerId, candidateKeys, draftInsertedAt, isCreateMode) {
     if (candidateKeys.length === 0)
         return [];
-    const rows = (await unsafeReadRetrying(db, `SELECT "id", "storage_key" FROM "file_refs"
+    const rows = await unsafeReadRetrying(db, `SELECT "id", "storage_key" FROM "file_refs"
      WHERE "tenant_id" = $1 AND "inserted_by_id" = $2
        AND "storage_key" = ANY($3::text[]) AND "is_deleted" = false
-       AND ($5::boolean OR "inserted_at" > $4::timestamptz)`, [tenantId, ownerId, candidateKeys, draftInsertedAt.toString(), isCreateMode]));
+       AND ($5::boolean OR "inserted_at" > $4::timestamptz)`, [tenantId, ownerId, candidateKeys, draftInsertedAt.toString(), isCreateMode]);
     return rows.map((row) => ({ id: row.id, storageKey: row.storage_key }));
 }

package/dist/form-draft/handlers/discard.write.d.ts

@@ -3,4 +3,4 @@ export declare const discardDraftWrite: import("@cosmicdrift/kumiko-types/define
     releaseFiles: import("zod").ZodOptional<import("zod").ZodBoolean>;
 }, import("zod/v4/core").$strip>, {
     discarded: boolean;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/form-draft/handlers/save.write.d.ts

@@ -2,4 +2,4 @@ export declare const saveDraftWrite: import("@cosmicdrift/kumiko-types/define-ha
     draftKey: import("zod").ZodString;
     values: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>;
     stepIndex: import("zod").ZodNumber;
-}, import("zod/v4/core").$strip>, import("@cosmicdrift/kumiko-types/hooks").SaveContext, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("zod/v4/core").$strip>, import("@cosmicdrift/kumiko-types/hooks").SaveContext, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/form-draft/release-file-refs.js

@@ -1,3 +1,4 @@
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 // The draft blob's `values` is free-form by design (issue #1889: form-draft
 // never knows the consuming form's field schema, only { values, stepIndex,
 // savedAt }). A FileRef pointer is therefore recognised purely by shape —
@@ -6,9 +7,9 @@
 // step writes into the draft, whether under a single "file" field or nested
 // in a "files"/"images" array.
 function isFileRefPointer(value) {
-    if (typeof value !== "object" || value === null)
+    if (!isPlainObject(value))
         return false;
-    const storageKey = value.storageKey;
+    const storageKey = value["storageKey"];
     return typeof storageKey === "string" && storageKey.length > 0;
 }
 function collectStorageKeys(value, keys) {

package/dist/inbound-mail-foundation/handlers/connect-account.write.js

@@ -70,7 +70,7 @@ export const connectAccountHandler = {
             authMethod: payload.authMethod,
             ownerUserId,
             displayName: payload.displayName,
-            address: encryptedFields["address"],
+            address: encryptedFields.address,
             // active ab Connect — der Supervisor greift den Account beim
             // nächsten Tick auf und degradiert ihn bei Credential-Fehlern.
             status: InboundMailAccountStatuses.active,

package/dist/inbound-mail-foundation/handlers/ingest-message.write.js

@@ -165,11 +165,11 @@ export const ingestMessageHandler = {
             ownerUserId: payload.ownerUserId,
             messageIdHeader: effectiveMessageIdHeader,
             threadKey,
-            from: encryptedMessageFields["from"],
-            to: encryptedMessageFields["to"],
-            cc: encryptedMessageFields["cc"],
-            subject: encryptedMessageFields["subject"],
-            snippet: encryptedMessageFields["snippet"],
+            from: encryptedMessageFields.from,
+            to: encryptedMessageFields.to,
+            cc: encryptedMessageFields.cc,
+            subject: encryptedMessageFields.subject,
+            snippet: encryptedMessageFields.snippet,
             receivedAtIso: payload.receivedAtIso,
             bodyRef: payload.bodyRef,
             scope: payload.scope,
@@ -246,7 +246,7 @@ export const ingestMessageHandler = {
             });
             const threadEventPayload = {
                 threadKey,
-                subject: encryptedThreadFields["subject"],
+                subject: encryptedThreadFields.subject,
                 lastMessageAtIso: newLastAt,
                 messageCount,
             };

package/dist/inbound-mail-foundation/handlers/scope-visibility.d.ts

@@ -1,4 +1,4 @@
-export declare function isVisibleToCaller(row: unknown, user: {
+export declare function isVisibleToCaller(row: Readonly<Record<string, unknown>>, user: {
     readonly id: string;
     readonly roles: readonly string[];
 }): boolean;

package/dist/inbound-mail-foundation/oauth-access-token.js

@@ -82,14 +82,17 @@ export function createOAuthAccessTokenManager(deps) {
         const secretKey = inboundCredentialSecretKey(account.id);
         return transaction(deps.db, async (tx) => {
             await acquireNamespacedAdvisoryLock(tx, OAUTH_REFRESH_LOCK_NAMESPACE, lockKey(account));
-            const stored = await deps.secrets.get(account.tenantId, secretKey);
+            // Secret read/write join the lock transaction: a second pool connection per refresh
+            // would exhaust a small pool when many accounts refresh at once.
+            const secrets = deps.secrets.withRunner(tx);
+            const stored = await secrets.get(account.tenantId, secretKey);
             if (!stored) {
                 throw new InboundAuthError("no refresh token stored for account");
             }
             const currentRefreshToken = stored.reveal();
             const tokens = await refreshWithTimeout(plugin, account, currentRefreshToken);
             if (tokens.refreshToken && tokens.refreshToken !== currentRefreshToken) {
-                await deps.secrets.set(account.tenantId, secretKey, tokens.refreshToken, inboundRefreshTokenSecretOptions(account.id));
+                await secrets.set(account.tenantId, secretKey, tokens.refreshToken, inboundRefreshTokenSecretOptions(account.id));
             }
             remember(account.id, tokens);
             return tokens.accessToken;
@@ -117,7 +120,9 @@ export function createOAuthAccessTokenManager(deps) {
         async storeRefreshToken(account, refreshToken) {
             await transaction(deps.db, async (tx) => {
                 await acquireNamespacedAdvisoryLock(tx, OAUTH_REFRESH_LOCK_NAMESPACE, lockKey(account));
-                await deps.secrets.set(account.tenantId, inboundCredentialSecretKey(account.id), refreshToken, inboundRefreshTokenSecretOptions(account.id));
+                await deps.secrets
+                    .withRunner(tx)
+                    .set(account.tenantId, inboundCredentialSecretKey(account.id), refreshToken, inboundRefreshTokenSecretOptions(account.id));
             });
             cache.delete(account.id);
         },

package/dist/inbound-mail-foundation/oauth-state.js

@@ -11,6 +11,7 @@
 // HMAC-Input, timing-safe compare, Expiry im Klartext-Segment).
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 const STATE_PURPOSE = "inbound-mail-oauth-connect";
 function sign(input, secret) {
     return createHmac("sha256", secret).update(input).digest("base64url");
@@ -60,12 +61,11 @@ export function verifyOAuthState(state, secret, now = Temporal.Now.instant()) {
     return { ok: true, payload: parsed };
 }
 function isOAuthStatePayload(v) {
-    if (typeof v !== "object" || v === null)
+    if (!isPlainObject(v))
         return false;
-    const o = v;
-    return (typeof o["tenantId"] === "string" &&
-        (o["ownerUserId"] === null || typeof o["ownerUserId"] === "string") &&
-        typeof o["providerKey"] === "string" &&
-        typeof o["mailbox"] === "string" &&
-        typeof o["nonce"] === "string");
+    return (typeof v["tenantId"] === "string" &&
+        (v["ownerUserId"] === null || typeof v["ownerUserId"] === "string") &&
+        typeof v["providerKey"] === "string" &&
+        typeof v["mailbox"] === "string" &&
+        typeof v["nonce"] === "string");
 }

package/dist/inbound-mail-foundation/types.js

@@ -64,14 +64,14 @@ export class InboundTransientError extends Error {
     }
 }
 export function isInboundAuthError(e) {
-    return e instanceof Error && e.kind === "inbound-auth-error";
+    return e instanceof Error && "kind" in e && e.kind === "inbound-auth-error";
 }
 export function isInboundRateLimitError(e) {
-    return e instanceof Error && e.kind === "inbound-rate-limit-error";
+    return e instanceof Error && "kind" in e && e.kind === "inbound-rate-limit-error";
 }
 export function isInboundCursorInvalidError(e) {
-    return e instanceof Error && e.kind === "inbound-cursor-invalid-error";
+    return e instanceof Error && "kind" in e && e.kind === "inbound-cursor-invalid-error";
 }
 export function isInboundTransientError(e) {
-    return e instanceof Error && e.kind === "inbound-transient-error";
+    return e instanceof Error && "kind" in e && e.kind === "inbound-transient-error";
 }

package/dist/inbound-mail-foundation/watch-supervisor.js

@@ -46,6 +46,7 @@
 import { fetchOne, insertOne, selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, decryptPiiFieldValues, } from "@cosmicdrift/kumiko-framework/crypto";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { InboundMailAccountStatuses, InboundMailFoundationHandlers } from "./constants.js";
 import { MAIL_ACCOUNT_PII_FIELDS, syncCursorTable } from "./entities.js";
 import { createOAuthAccessTokenManager, usesFoundationManagedOAuth, } from "./oauth-access-token.js";
@@ -111,20 +112,29 @@ export function createInboundMailSupervisor(deps) {
         });
         const piiKms = configuredPiiSubjectKms();
         const records = [];
-        for (const raw of rows) {
-            const row = piiKms
-                ? await decryptPiiFieldValues(raw, MAIL_ACCOUNT_PII_FIELDS, piiKms, { requestId: "inbound-mail-foundation:supervisor:list-accounts" })
-                : raw;
+        for (const row of rows) {
+            const decrypted = piiKms
+                ? await decryptPiiFieldValues(row, MAIL_ACCOUNT_PII_FIELDS, piiKms, {
+                    requestId: "inbound-mail-foundation:supervisor:list-accounts",
+                })
+                : row;
+            const decryptedAddress = decrypted["address"];
+            // Falling back to row.address would hand the ciphertext to a provider.
+            // One undecryptable account must not stop polling of every other tenant's accounts.
+            if (typeof decryptedAddress !== "string") {
+                log(`inbound-mail: account ${row.id} skipped — address did not decrypt to text`);
+                continue;
+            }
             records.push({
-                id: row["id"],
-                tenantId: row["tenantId"],
-                provider: row["provider"],
-                authMethod: row["authMethod"],
-                ownerUserId: row["ownerUserId"] ?? null,
-                address: row["address"],
-                displayName: row["displayName"] ?? "",
+                id: row.id,
+                tenantId: row.tenantId,
+                provider: row.provider,
+                authMethod: row.authMethod,
+                ownerUserId: row.ownerUserId ?? null,
+                address: decryptedAddress,
+                displayName: row.displayName ?? "",
                 status: InboundMailAccountStatuses.active,
-                watchState: row["watchState"] ?? "idle",
+                watchState: row.watchState ?? "idle",
             });
         }
         return records;
@@ -140,7 +150,8 @@ export function createInboundMailSupervisor(deps) {
         if (!row)
             return null;
         try {
-            return JSON.parse(row.cursor); // @cast-boundary eigene JSON-Persistenz
+            const parsed = JSON.parse(row.cursor);
+            return isPlainObject(parsed) ? parsed : null;
         }
         catch {
             return null; // korrupter Cursor = wie kein Cursor → Backfill, Dedup fängt Dubletten

package/dist/inbound-provider-imap/imap-client.js

@@ -6,6 +6,7 @@ import { InboundAuthError, InboundCursorInvalidError, InboundTransientError, } f
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { legacyDateToInstant } from "@cosmicdrift/kumiko-framework/time";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { ImapFlow } from "imapflow";
 import { simpleParser } from "mailparser";
 export const IMAP_MAILBOX = "INBOX";
@@ -73,10 +74,10 @@ export function mapImapError(err, host) {
     // imapflow-Fehler tragen die Server-Antwort in responseText, die
     // message ist nur "Command failed" — beides in den Match einbeziehen;
     // authenticationFailed ist das verlässliche Flag.
-    const carrier = err;
-    const responseText = typeof carrier?.responseText === "string" ? carrier.responseText : "";
+    const carrier = isPlainObject(err) ? err : undefined;
+    const responseText = typeof carrier?.["responseText"] === "string" ? carrier["responseText"] : "";
     const msg = `${err instanceof Error ? err.message : String(err)} ${responseText}`.trim();
-    if (carrier?.authenticationFailed === true ||
+    if (carrier?.["authenticationFailed"] === true ||
         /auth(entication)? failed|invalid credentials|invalid login|LOGIN failed|AUTHENTICATIONFAILED/i.test(msg)) {
         return new InboundAuthError(`IMAP auth failed at ${host}: ${msg}`);
     }

package/dist/jobs/db/queries/stale-run-sweep.d.ts

@@ -5,4 +5,4 @@ export type StaleRunSweepResult = {
     readonly tenantRunsMarkedFailed: number;
     readonly tenantQueuedDropped: number;
 };
-export declare function markStaleJobRunsFailed(db: DbConnection, timeoutHours: number): Promise<StaleRunSweepResult>;
+export declare function markStaleJobRunsFailed(db: DbConnection, timeoutHours: number, queuedRetentionDays?: number): Promise<StaleRunSweepResult>;

package/dist/jobs/db/queries/stale-run-sweep.js

@@ -13,20 +13,26 @@
 // (retry.write.ts only allows retry from "failed").
 import { deleteManyBatched, selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { mapWithConcurrency } from "../../../shared/index.js";
+import { DEFAULT_JOB_RUN_RETENTION_DAYS } from "../../handlers/retention-cleanup.job.js";
 import { encryptFailureError } from "../../job-run-logger.js";
 import { jobRunsTable } from "../../job-run-table.js";
 import { tenantJobRunsTable } from "../../tenant-job-run-table.js";
 const KMS_POOL_CONCURRENCY = 4;
 const STALE_DELETE_BATCH_SIZE = 500;
 export const STALE_JOB_RUN_ERROR = "job run exceeded the stale-run timeout without a completion signal (likely a crashed worker process)";
-export async function markStaleJobRunsFailed(db, timeoutHours) {
+// A queued tenant row can legitimately wait much longer than a run takes (backlog, delay/backoff,
+// sequential requeue), so it is only treated as lost once it is older than the retention window,
+// not after the running-timeout.
+export async function markStaleJobRunsFailed(db, timeoutHours, queuedRetentionDays = DEFAULT_JOB_RUN_RETENTION_DAYS) {
     const cutoff = Temporal.Now.instant().subtract({ hours: timeoutHours });
+    const queuedCutoff = Temporal.Now.instant().subtract({ hours: queuedRetentionDays * 24 });
     const now = Temporal.Now.instant();
     // Fetch the matched rows first: `error` carries the same per-triggering-
     // user subject annotation as job-run-logger.ts's onJobFailed path
     // (personal: { of: "triggeredById" } on job-run-table.ts), so it is encrypted
-    // under that subject's DEK. Runs are grouped by subject: one encrypt and one
-    // updateMany per subject instead of per run.
+    // under the triggering user's DEK, or the system tenant key when
+    // triggeredById is null (whenAbsent: "tenant", fw#3654). Runs are grouped by
+    // that subject: one encrypt and one updateMany per subject instead of per run.
     const stale = await selectMany(db, jobRunsTable, {
         status: "running",
         startedAt: { lt: cutoff },
@@ -61,9 +67,10 @@ export async function markStaleJobRunsFailed(db, timeoutHours) {
     const runsMarkedFailed = updatedPerSubject.reduce((sum, count) => sum + count, 0);
     // Tenant-visible run state follows the same clock: a running row whose
     // worker died is a failure, a queued row that never started (job lost from
-    // Redis, enqueue hook without a run) would otherwise show "waiting" forever.
+    // Redis, enqueue hook without a run) would otherwise show "waiting" forever;
+    // it is dropped once it has outlived the retention window.
     const tenantRunsFailed = await updateMany(db, tenantJobRunsTable, { status: "failed", finishedAt: now, updatedAt: now }, { status: "running", startedAt: { lt: cutoff } });
-    const tenantQueuedStale = await deleteManyBatched(db, tenantJobRunsTable, { status: "queued", updatedAt: { lt: cutoff } }, { limit: STALE_DELETE_BATCH_SIZE });
+    const tenantQueuedStale = await deleteManyBatched(db, tenantJobRunsTable, { status: "queued", updatedAt: { lt: queuedCutoff } }, { limit: STALE_DELETE_BATCH_SIZE });
     return {
         runsMarkedFailed,
         tenantRunsMarkedFailed: tenantRunsFailed.length,

package/dist/jobs/feature.js

@@ -19,7 +19,7 @@ export function createJobsFeature(options = {}) {
     const retentionDays = options.retentionDays ?? DEFAULT_JOB_RUN_RETENTION_DAYS;
     const staleRunTimeoutHours = options.staleRunTimeoutHours ?? DEFAULT_JOB_RUN_STALE_TIMEOUT_HOURS;
     return defineFeature("jobs", (r) => {
-        r.describe("Persistence and operator tooling for background jobs registered via `r.job(...)`. Every job execution writes directly into `store_job_runs` (current status + duration) and `store_job_run_logs` (per-line log rows) from the BullMQ callbacks — no event stream in between (#2243). A daily `retention-cleanup` job deletes runs (and their logs) older than `retentionDays`; an hourly `stale-run-sweep` job marks runs stuck at status `running` past `staleRunTimeoutHours` as `failed` (#2246 — a crashed worker never fires the completion callback, so nothing else ever revisits the row). Exposes `jobs:write:trigger` (manual run) and `jobs:write:retry` (operator retry of a failed run), plus `jobs:query:list`, `jobs:query:details`, and `jobs:query:catalog` (manual jobs) for the operator UI. A job that declares `tenantVisibleFailure` also records its last failed attempt per tenant and subject in `store_tenant_job_failures`, which the tenant itself reads through `jobs:query:failures` — a translation key only, never the provider's message (fw#3079). A job that declares `tenantVisibleRun` also keeps its run state per tenant and subject in `store_tenant_job_runs` (queued, running, plus the latest completed or failed run, no payload, error text or logs), which the tenant reads through `jobs:query:tenant-runs` (fw#3616); the stale-run sweep fails its stuck `running` rows and drops its stuck `queued` rows.");
+        r.describe("Persistence and operator tooling for background jobs registered via `r.job(...)`. Every job execution writes directly into `store_job_runs` (current status + duration) and `store_job_run_logs` (per-line log rows) from the BullMQ callbacks — no event stream in between (#2243). A daily `retention-cleanup` job deletes runs (and their logs) older than `retentionDays`; an hourly `stale-run-sweep` job marks runs stuck at status `running` past `staleRunTimeoutHours` as `failed` (#2246 — a crashed worker never fires the completion callback, so nothing else ever revisits the row). Exposes `jobs:write:trigger` (manual run) and `jobs:write:retry` (operator retry of a failed run), plus `jobs:query:list`, `jobs:query:details`, and `jobs:query:catalog` (manual jobs) for the operator UI. A job that declares `tenantVisibleFailure` also records its last failed attempt per tenant and subject in `store_tenant_job_failures`, which the tenant itself reads through `jobs:query:failures` — a translation key only, never the provider's message (fw#3079). A job that declares `tenantVisibleRun` also keeps its run state per tenant and subject in `store_tenant_job_runs` (queued, running, plus the latest completed or failed run, no payload, error text or logs), which the tenant reads through `jobs:query:tenant-runs` (fw#3616); the stale-run sweep fails its stuck `running` rows and drops `queued` rows older than `retentionDays`.");
         r.uiHints({
             displayLabel: "Jobs · Audit & Operator UI",
             category: "operations",
@@ -28,7 +28,9 @@ export function createJobsFeature(options = {}) {
         r.systemScope();
         r.storeTable(jobRunsTableMeta, {
             reason: "direct_write.job_runs",
-            // payload/error carry personal:{of:"triggeredById"} (job-run-table.ts).
+            // payload/error carry personal:{of:"triggeredById"} (job-run-table.ts): encrypted under the
+            // triggering user's DEK, or the system tenant key when triggeredById is null
+            // (whenAbsent: "tenant", fw#3654).
             // job-run-logger.ts manually encrypts both before every insert/update
             // (encryptStartedPayload/encryptFailureError) since this store bypasses
             // the executor's automatic PII pipeline (#2243).
@@ -63,7 +65,7 @@ export function createJobsFeature(options = {}) {
         // frequent enough to catch a stuck run soon after it crosses the
         // threshold, cheap enough that an (almost always empty) result set
         // doesn't matter.
-        r.job("stale-run-sweep", { trigger: { cron: "0 * * * *" }, concurrency: "skip" }, createStaleRunSweepJob(staleRunTimeoutHours));
+        r.job("stale-run-sweep", { trigger: { cron: "0 * * * *" }, concurrency: "skip" }, createStaleRunSweepJob(staleRunTimeoutHours, retentionDays));
         const handlers = {
             trigger: r.writeHandler(triggerWrite),
             retry: r.writeHandler(retryWrite),

package/dist/jobs/handlers/list.query.js

@@ -7,6 +7,8 @@ import { decryptStoredPii, mapWithConcurrency } from "../../shared/index.js";
 import { jobRunsTable } from "../job-run-table.js";
 const KMS_POOL_CONCURRENCY = 4;
 const DEFAULT_PAGE_SIZE = 50;
+// The offset cursor re-reads everything up to the page end, so the page size bounds that read.
+const MAX_LIST_LIMIT = 200;
 const jobRunStatusSchema = z.enum(["queued", "running", "completed", "failed"]);
 async function decryptRunRow(row) {
     let result = row;
@@ -56,7 +58,7 @@ export const listQuery = defineQueryHandler({
             .optional(),
         sort: z.enum(["jobName", "status", "startedAt", "duration"]).optional(),
         sortDirection: z.enum(["asc", "desc"]).optional(),
-        limit: z.number().int().min(1).optional(),
+        limit: z.number().int().min(1).max(MAX_LIST_LIMIT).optional(),
         cursor: z.string().optional(),
         totalCount: z.boolean().optional(),
     }),

package/dist/jobs/handlers/retry.write.d.ts

@@ -5,4 +5,4 @@ export declare const retryWrite: import("@cosmicdrift/kumiko-types/define-handle
     jobName: string;
     bullJobId: string;
     retriedFromRunId: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/jobs/handlers/stale-run-sweep.job.d.ts

@@ -1,3 +1,3 @@
 import type { JobHandlerFn } from "@cosmicdrift/kumiko-framework/engine";
 export declare const DEFAULT_JOB_RUN_STALE_TIMEOUT_HOURS = 24;
-export declare function createStaleRunSweepJob(timeoutHours: number): JobHandlerFn;
+export declare function createStaleRunSweepJob(timeoutHours: number, queuedRetentionDays: number): JobHandlerFn;

package/dist/jobs/handlers/stale-run-sweep.job.js

@@ -9,7 +9,7 @@ import { markStaleJobRunsFailed } from "../db/queries/stale-run-sweep.js";
 // default has to clear any plausible real job, not just be "long".
 // Configurable per-app via JobsFeatureOptions.staleRunTimeoutHours.
 export const DEFAULT_JOB_RUN_STALE_TIMEOUT_HOURS = 24;
-export function createStaleRunSweepJob(timeoutHours) {
+export function createStaleRunSweepJob(timeoutHours, queuedRetentionDays) {
     return async (_payload, ctx) => {
         if (!ctx.systemDb) {
             throw new InternalError({
@@ -17,7 +17,7 @@ export function createStaleRunSweepJob(timeoutHours) {
             });
         }
         const db = ctx.systemDb.unsafeRaw("stale-run sweep marks stuck runs of every tenant as failed"); // @cast-boundary db-operator — DbRunner narrows to DbConnection, jobs never run inside a DbTx
-        const result = await markStaleJobRunsFailed(db, timeoutHours);
+        const result = await markStaleJobRunsFailed(db, timeoutHours, queuedRetentionDays);
         ctx.log?.info?.(`[jobs:stale-run-sweep] complete: ${JSON.stringify(result)}`);
     };
 }