@cosmicdrift/kumiko-bundled-features 0.363.0 → 0.364.0

package/dist/delivery/jobs.js

@@ -36,6 +36,8 @@ const sendJobPayloadSchema = renderJobPayloadSchema.extend({
         html: z.string(),
         subject: z.string(),
         text: z.string().optional(),
+        fromName: z.string().optional(),
+        replyTo: z.string().optional(),
         attachments: z.array(emailAttachmentRefSchema).max(MAX_EMAIL_ATTACHMENTS).optional(),
     })
         .optional(),
@@ -63,6 +65,8 @@ function toSendRendered(rendered) {
         html: rendered.html,
         subject: rendered.subject,
         ...(rendered.text !== undefined && { text: rendered.text }),
+        ...(rendered.fromName !== undefined && { fromName: rendered.fromName }),
+        ...(rendered.replyTo !== undefined && { replyTo: rendered.replyTo }),
         ...(rendered.attachments !== undefined && {
             attachments: rendered.attachments.map(toAttachmentRef),
         }),
@@ -96,12 +100,11 @@ function entryFor(p, status, error, address, confirmed) {
         ...(confirmed === false && { confirmed }),
     };
 }
-// Only the final retry frees the key: earlier failures are retried by the runner and
-// must still dedup. Assumes ctx.redis is the handle the service claimed on; runProdApp
-// wires the same instance into both.
-async function releaseIdempotencyOnTerminalFailure(ctx, p) {
-    // skip: nothing to release before the last attempt or without an idempotency key
-    if (!ctx.finalAttempt || !p.idempotencyKey)
+// Assumes ctx.redis is the handle the service claimed on; runProdApp wires the same
+// instance into both.
+async function releaseIdempotencyKey(ctx, p) {
+    // skip: no idempotency key was claimed for this notification
+    if (!p.idempotencyKey)
         return;
     if (!ctx.redis) {
         ctx.log.warn("delivery: idempotency key not released, job context has no redis", {
@@ -118,6 +121,26 @@ async function releaseIdempotencyOnTerminalFailure(ctx, p) {
         });
     }
 }
+// Only the final retry frees the key: earlier failures are retried by the runner and
+// must still dedup.
+async function releaseIdempotencyOnTerminalFailure(ctx, p) {
+    // skip: not the last attempt, the runner retries and the key must keep deduplicating
+    if (!ctx.finalAttempt)
+        return;
+    await releaseIdempotencyKey(ctx, p);
+}
+// Covers every throw after the payload parsed, not just the attempt-logged ones: a
+// missing registry or unknown channel on the last attempt would otherwise hold the key
+// until its TTL.
+async function releasingKeyOnTerminalFailure(ctx, p, run) {
+    try {
+        return await run();
+    }
+    catch (err) {
+        await releaseIdempotencyOnTerminalFailure(ctx, p);
+        throw err;
+    }
+}
 // The job runner stores err.message in the run row, and BullMQ keeps failedReason and
 // the stack trace in Redis in plain text, so the rethrown error carries only the code.
 // The redacted message goes to the log.
@@ -128,7 +151,6 @@ async function failAttempt(ctx, db, registry, p, code, err) {
         channel: p.channelName,
     });
     await appendAttemptEvent(db, registry, p.deliveryAttemptId, entryFor(p, "failed", code, p.address));
-    await releaseIdempotencyOnTerminalFailure(ctx, p);
     throw new Error(code);
 }
 // Render the message and hand off to delivery.send. On failure: record the
@@ -136,10 +158,13 @@ async function failAttempt(ctx, db, registry, p, code, err) {
 // the send step is never reached, so a stuck render can't half-send.
 export const deliveryRenderJob = async (payload, ctx) => {
     const p = renderJobPayloadSchema.parse(payload);
+    return releasingKeyOnTerminalFailure(ctx, p, () => renderStep(p, ctx));
+};
+async function renderStep(p, ctx) {
     const tenantId = p.tenantId; // @cast-boundary engine-payload — stream tenant
     const { db, registry } = requireTenantScopedDeps(ctx, tenantId);
     const channel = resolveChannel(registry, p.channelName);
-    const channelCtx = buildChannelContext(db, registry, undefined, tenantId, ctx.secrets, ctx.config, (fileTenantId) => fileContextForTenant(ctx, fileTenantId));
+    const channelCtx = buildChannelContext(db, registry, undefined, tenantId, ctx.secrets, ctx.config, (fileTenantId) => fileContextForTenant(ctx, ctx.systemUser.tenantId, fileTenantId));
     let rendered;
     try {
         if (!channel.render) {
@@ -157,21 +182,28 @@ export const deliveryRenderJob = async (payload, ctx) => {
     catch (err) {
         return failAttempt(ctx, db, registry, p, "channel_error", err);
     }
-};
+}
 // Deliver via the channel using the rendered payload (if any). On failure:
 // record the terminal failed event and rethrow so BullMQ retries the send with
 // the same already-rendered HTML — no re-render needed.
 export const deliverySendJob = async (payload, ctx) => {
     const p = sendJobPayloadSchema.parse(payload);
+    return releasingKeyOnTerminalFailure(ctx, p, () => sendStep(p, ctx));
+};
+async function sendStep(p, ctx) {
     const tenantId = p.tenantId; // @cast-boundary engine-payload — stream tenant
     const { db, registry } = requireTenantScopedDeps(ctx, tenantId);
     const channel = resolveChannel(registry, p.channelName);
-    const channelCtx = buildChannelContext(db, registry, undefined, tenantId, ctx.secrets, ctx.config, (fileTenantId) => fileContextForTenant(ctx, fileTenantId));
+    const channelCtx = buildChannelContext(db, registry, undefined, tenantId, ctx.secrets, ctx.config, (fileTenantId) => fileContextForTenant(ctx, ctx.systemUser.tenantId, fileTenantId));
     try {
         const result = await channel.send(p.address, toMessage(p), channelCtx, p.rendered);
         await appendAttemptEvent(db, registry, p.deliveryAttemptId, entryFor(p, result.status, result.error ?? null, result.address ?? p.address, result.confirmed));
+        // A soft failure ends the job successfully, so no retry follows and the caller's
+        // retry must not be skipped as a duplicate.
+        if (result.status === "failed")
+            await releaseIdempotencyKey(ctx, p);
     }
     catch (err) {
         return failAttempt(ctx, db, registry, p, "send_failed", err);
     }
-};
+}

package/dist/delivery/types.d.ts

@@ -3,7 +3,7 @@ import type { DbConnection, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { DeliveryErrorCode, NotifyDeliveryStatus, NotifyDispatched, NotifyJobDispatcher, NotifyOptions, NotifyPriority, Registry, SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { FileProviderResolver } from "@cosmicdrift/kumiko-framework/files";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
-import type { MailPayload } from "../renderer-foundation/index.js";
+import type { MailPayload, RenderedTemplateRef } from "../renderer-foundation/index.js";
 import type { EmailAttachmentRef } from "./attachment-ref.js";
 import { DELIVERY_CHANNEL_EXTENSION } from "./constants.js";
 export type RenderedMail = {
@@ -11,7 +11,11 @@ export type RenderedMail = {
     readonly html: string;
     readonly text: string;
     readonly previewText?: string;
+    readonly fromName?: string;
+    readonly replyTo?: string;
     readonly attachments?: readonly EmailAttachmentRef[];
+    /** The layout version the html was rendered through; the editor preview names it. */
+    readonly layout?: RenderedTemplateRef;
 };
 export type ChannelContext = {
     readonly db: TenantDb;
@@ -43,6 +47,8 @@ export type RenderedMessage = {
     readonly html: string;
     readonly subject: string;
     readonly text?: string;
+    readonly fromName?: string;
+    readonly replyTo?: string;
     readonly attachments?: readonly EmailAttachmentRef[];
 };
 export declare const DELIVERY_CHANNEL_MODES: readonly ["inline", "queued"];

package/dist/feature-toggles/handlers/set.write.d.ts

@@ -7,4 +7,4 @@ export declare function createSetWriteHandler(getRuntime: (() => GlobalFeatureTo
     featureName: string;
     enabled: boolean;
     previousEnabled: boolean | null;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/file-derivatives/handlers/public-variant.query.js

@@ -99,7 +99,7 @@ export const publicVariantQuery = defineQueryHandler({
         if (!spec)
             return null;
         const result = await derivatives.variant(query.payload.fileRefId, spec, query.payload.variant);
-        const bytes = await files.ref(result.storageKey).read();
+        const bytes = await files.refFromFileRef(result).read();
         // ponytail: fully buffered (no streaming), +33% over the wire from
         // base64 — HttpRouteHandlerDeps only exposes {app, systemQuery} (no
         // direct ctx.files access from the Hono handler itself), and the local

package/dist/file-foundation/read-file-ref-content.d.ts

@@ -9,7 +9,7 @@ export type FileRefContent = {
 export declare function fileContextForTenant(ctx: {
     readonly _fileProviderResolver?: FileProviderResolver | undefined;
     readonly files?: FileContext | undefined;
-}, tenantId: string): FileContext | undefined;
+}, contextTenantId: string, tenantId: string): FileContext | undefined;
 export declare function fileContextFromResolver(resolver: FileProviderResolver, tenantId: string): FileContext;
 export declare class FileRefTooLargeError extends Error {
     readonly size: number;

package/dist/file-foundation/read-file-ref-content.js

@@ -1,11 +1,13 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { isUuid } from "@cosmicdrift/kumiko-framework/engine";
 import { createFileContext, fileRefsTable, } from "@cosmicdrift/kumiko-framework/files";
-// Tenant-bound on purpose: the FileContext of the current request only reaches its own key space.
-export function fileContextForTenant(ctx, tenantId) {
+// Tenant-bound on purpose: without a resolver `ctx.files` only reaches the storage of the
+// context's own tenant (`contextTenantId`), so a request for another tenant's files is
+// undefined instead of silently reading through the wrong tenant's storage.
+export function fileContextForTenant(ctx, contextTenantId, tenantId) {
     const resolver = ctx._fileProviderResolver;
     if (resolver === undefined)
-        return ctx.files;
+        return tenantId === contextTenantId ? ctx.files : undefined;
     return fileContextFromResolver(resolver, tenantId);
 }
 export function fileContextFromResolver(resolver, tenantId) {
@@ -44,6 +46,6 @@ export async function readFileRefContent(args) {
     if (files === undefined) {
         throw new Error("readFileRefContent: no file storage is available for the file's tenant");
     }
-    const content = await files.ref(row.storageKey).read();
+    const content = await files.refFromFileRef(row).read();
     return { content, contentType: row.mimeType, tenantId: row.tenantId, size };
 }

package/dist/files-tenant-data/hooks.js

@@ -97,6 +97,7 @@ export const fileRefTenantDestroyHook = async (ctx) => {
         },
         maxFailures: 1,
         deadlineAt: ctx.deadlineAt ?? Number.POSITIVE_INFINITY,
+        minBatches: 1,
         onRowError: (_row, err) => {
             firstFailure = err instanceof Error ? err.message : String(err);
         },
@@ -176,6 +177,9 @@ export const fileRefStorageDestroyHook = async (tenantId, ctx) => {
             },
             maxFailures: 1,
             deadlineAt: ctx.deadlineAt ?? Number.POSITIVE_INFINITY,
+            // list() and the survivor lookup above can use up the whole budget; one chunk per tick
+            // still deletes, so the stage never reports "no progress".
+            minBatches: 1,
             onRowError: (_key, err) => {
                 firstFailure = err instanceof Error ? err.message : String(err);
             },

package/dist/form-draft/handlers/discard.write.d.ts

@@ -3,4 +3,4 @@ export declare const discardDraftWrite: import("@cosmicdrift/kumiko-types/define
     releaseFiles: import("zod").ZodOptional<import("zod").ZodBoolean>;
 }, import("zod/v4/core").$strip>, {
     discarded: boolean;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/form-draft/handlers/save.write.d.ts

@@ -2,4 +2,4 @@ export declare const saveDraftWrite: import("@cosmicdrift/kumiko-types/define-ha
     draftKey: import("zod").ZodString;
     values: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>;
     stepIndex: import("zod").ZodNumber;
-}, import("zod/v4/core").$strip>, import("@cosmicdrift/kumiko-types/hooks").SaveContext, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("zod/v4/core").$strip>, import("@cosmicdrift/kumiko-types/hooks").SaveContext, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/inbound-mail-foundation/oauth-access-token.js

@@ -82,14 +82,17 @@ export function createOAuthAccessTokenManager(deps) {
         const secretKey = inboundCredentialSecretKey(account.id);
         return transaction(deps.db, async (tx) => {
             await acquireNamespacedAdvisoryLock(tx, OAUTH_REFRESH_LOCK_NAMESPACE, lockKey(account));
-            const stored = await deps.secrets.get(account.tenantId, secretKey);
+            // Secret read/write join the lock transaction: a second pool connection per refresh
+            // would exhaust a small pool when many accounts refresh at once.
+            const secrets = deps.secrets.withRunner(tx);
+            const stored = await secrets.get(account.tenantId, secretKey);
             if (!stored) {
                 throw new InboundAuthError("no refresh token stored for account");
             }
             const currentRefreshToken = stored.reveal();
             const tokens = await refreshWithTimeout(plugin, account, currentRefreshToken);
             if (tokens.refreshToken && tokens.refreshToken !== currentRefreshToken) {
-                await deps.secrets.set(account.tenantId, secretKey, tokens.refreshToken, inboundRefreshTokenSecretOptions(account.id));
+                await secrets.set(account.tenantId, secretKey, tokens.refreshToken, inboundRefreshTokenSecretOptions(account.id));
             }
             remember(account.id, tokens);
             return tokens.accessToken;
@@ -117,7 +120,9 @@ export function createOAuthAccessTokenManager(deps) {
         async storeRefreshToken(account, refreshToken) {
             await transaction(deps.db, async (tx) => {
                 await acquireNamespacedAdvisoryLock(tx, OAUTH_REFRESH_LOCK_NAMESPACE, lockKey(account));
-                await deps.secrets.set(account.tenantId, inboundCredentialSecretKey(account.id), refreshToken, inboundRefreshTokenSecretOptions(account.id));
+                await deps.secrets
+                    .withRunner(tx)
+                    .set(account.tenantId, inboundCredentialSecretKey(account.id), refreshToken, inboundRefreshTokenSecretOptions(account.id));
             });
             cache.delete(account.id);
         },

package/dist/inbound-mail-foundation/watch-supervisor.js

@@ -120,8 +120,10 @@ export function createInboundMailSupervisor(deps) {
                 : row;
             const decryptedAddress = decrypted["address"];
             // Falling back to row.address would hand the ciphertext to a provider.
+            // One undecryptable account must not stop polling of every other tenant's accounts.
             if (typeof decryptedAddress !== "string") {
-                throw new Error(`inbound-mail: address of mail account ${row.id} did not decrypt to text`);
+                log(`inbound-mail: account ${row.id} skipped — address did not decrypt to text`);
+                continue;
             }
             records.push({
                 id: row.id,

package/dist/jobs/db/queries/stale-run-sweep.d.ts

@@ -5,4 +5,4 @@ export type StaleRunSweepResult = {
     readonly tenantRunsMarkedFailed: number;
     readonly tenantQueuedDropped: number;
 };
-export declare function markStaleJobRunsFailed(db: DbConnection, timeoutHours: number): Promise<StaleRunSweepResult>;
+export declare function markStaleJobRunsFailed(db: DbConnection, timeoutHours: number, queuedRetentionDays?: number): Promise<StaleRunSweepResult>;

package/dist/jobs/db/queries/stale-run-sweep.js

@@ -13,20 +13,26 @@
 // (retry.write.ts only allows retry from "failed").
 import { deleteManyBatched, selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { mapWithConcurrency } from "../../../shared/index.js";
+import { DEFAULT_JOB_RUN_RETENTION_DAYS } from "../../handlers/retention-cleanup.job.js";
 import { encryptFailureError } from "../../job-run-logger.js";
 import { jobRunsTable } from "../../job-run-table.js";
 import { tenantJobRunsTable } from "../../tenant-job-run-table.js";
 const KMS_POOL_CONCURRENCY = 4;
 const STALE_DELETE_BATCH_SIZE = 500;
 export const STALE_JOB_RUN_ERROR = "job run exceeded the stale-run timeout without a completion signal (likely a crashed worker process)";
-export async function markStaleJobRunsFailed(db, timeoutHours) {
+// A queued tenant row can legitimately wait much longer than a run takes (backlog, delay/backoff,
+// sequential requeue), so it is only treated as lost once it is older than the retention window,
+// not after the running-timeout.
+export async function markStaleJobRunsFailed(db, timeoutHours, queuedRetentionDays = DEFAULT_JOB_RUN_RETENTION_DAYS) {
     const cutoff = Temporal.Now.instant().subtract({ hours: timeoutHours });
+    const queuedCutoff = Temporal.Now.instant().subtract({ hours: queuedRetentionDays * 24 });
     const now = Temporal.Now.instant();
     // Fetch the matched rows first: `error` carries the same per-triggering-
     // user subject annotation as job-run-logger.ts's onJobFailed path
     // (personal: { of: "triggeredById" } on job-run-table.ts), so it is encrypted
-    // under that subject's DEK. Runs are grouped by subject: one encrypt and one
-    // updateMany per subject instead of per run.
+    // under the triggering user's DEK, or the system tenant key when
+    // triggeredById is null (whenAbsent: "tenant", fw#3654). Runs are grouped by
+    // that subject: one encrypt and one updateMany per subject instead of per run.
     const stale = await selectMany(db, jobRunsTable, {
         status: "running",
         startedAt: { lt: cutoff },
@@ -61,9 +67,10 @@ export async function markStaleJobRunsFailed(db, timeoutHours) {
     const runsMarkedFailed = updatedPerSubject.reduce((sum, count) => sum + count, 0);
     // Tenant-visible run state follows the same clock: a running row whose
     // worker died is a failure, a queued row that never started (job lost from
-    // Redis, enqueue hook without a run) would otherwise show "waiting" forever.
+    // Redis, enqueue hook without a run) would otherwise show "waiting" forever;
+    // it is dropped once it has outlived the retention window.
     const tenantRunsFailed = await updateMany(db, tenantJobRunsTable, { status: "failed", finishedAt: now, updatedAt: now }, { status: "running", startedAt: { lt: cutoff } });
-    const tenantQueuedStale = await deleteManyBatched(db, tenantJobRunsTable, { status: "queued", updatedAt: { lt: cutoff } }, { limit: STALE_DELETE_BATCH_SIZE });
+    const tenantQueuedStale = await deleteManyBatched(db, tenantJobRunsTable, { status: "queued", updatedAt: { lt: queuedCutoff } }, { limit: STALE_DELETE_BATCH_SIZE });
     return {
         runsMarkedFailed,
         tenantRunsMarkedFailed: tenantRunsFailed.length,

package/dist/jobs/feature.js

@@ -19,7 +19,7 @@ export function createJobsFeature(options = {}) {
     const retentionDays = options.retentionDays ?? DEFAULT_JOB_RUN_RETENTION_DAYS;
     const staleRunTimeoutHours = options.staleRunTimeoutHours ?? DEFAULT_JOB_RUN_STALE_TIMEOUT_HOURS;
     return defineFeature("jobs", (r) => {
-        r.describe("Persistence and operator tooling for background jobs registered via `r.job(...)`. Every job execution writes directly into `store_job_runs` (current status + duration) and `store_job_run_logs` (per-line log rows) from the BullMQ callbacks — no event stream in between (#2243). A daily `retention-cleanup` job deletes runs (and their logs) older than `retentionDays`; an hourly `stale-run-sweep` job marks runs stuck at status `running` past `staleRunTimeoutHours` as `failed` (#2246 — a crashed worker never fires the completion callback, so nothing else ever revisits the row). Exposes `jobs:write:trigger` (manual run) and `jobs:write:retry` (operator retry of a failed run), plus `jobs:query:list`, `jobs:query:details`, and `jobs:query:catalog` (manual jobs) for the operator UI. A job that declares `tenantVisibleFailure` also records its last failed attempt per tenant and subject in `store_tenant_job_failures`, which the tenant itself reads through `jobs:query:failures` — a translation key only, never the provider's message (fw#3079). A job that declares `tenantVisibleRun` also keeps its run state per tenant and subject in `store_tenant_job_runs` (queued, running, plus the latest completed or failed run, no payload, error text or logs), which the tenant reads through `jobs:query:tenant-runs` (fw#3616); the stale-run sweep fails its stuck `running` rows and drops its stuck `queued` rows.");
+        r.describe("Persistence and operator tooling for background jobs registered via `r.job(...)`. Every job execution writes directly into `store_job_runs` (current status + duration) and `store_job_run_logs` (per-line log rows) from the BullMQ callbacks — no event stream in between (#2243). A daily `retention-cleanup` job deletes runs (and their logs) older than `retentionDays`; an hourly `stale-run-sweep` job marks runs stuck at status `running` past `staleRunTimeoutHours` as `failed` (#2246 — a crashed worker never fires the completion callback, so nothing else ever revisits the row). Exposes `jobs:write:trigger` (manual run) and `jobs:write:retry` (operator retry of a failed run), plus `jobs:query:list`, `jobs:query:details`, and `jobs:query:catalog` (manual jobs) for the operator UI. A job that declares `tenantVisibleFailure` also records its last failed attempt per tenant and subject in `store_tenant_job_failures`, which the tenant itself reads through `jobs:query:failures` — a translation key only, never the provider's message (fw#3079). A job that declares `tenantVisibleRun` also keeps its run state per tenant and subject in `store_tenant_job_runs` (queued, running, plus the latest completed or failed run, no payload, error text or logs), which the tenant reads through `jobs:query:tenant-runs` (fw#3616); the stale-run sweep fails its stuck `running` rows and drops `queued` rows older than `retentionDays`.");
         r.uiHints({
             displayLabel: "Jobs · Audit & Operator UI",
             category: "operations",
@@ -28,7 +28,9 @@ export function createJobsFeature(options = {}) {
         r.systemScope();
         r.storeTable(jobRunsTableMeta, {
             reason: "direct_write.job_runs",
-            // payload/error carry personal:{of:"triggeredById"} (job-run-table.ts).
+            // payload/error carry personal:{of:"triggeredById"} (job-run-table.ts): encrypted under the
+            // triggering user's DEK, or the system tenant key when triggeredById is null
+            // (whenAbsent: "tenant", fw#3654).
             // job-run-logger.ts manually encrypts both before every insert/update
             // (encryptStartedPayload/encryptFailureError) since this store bypasses
             // the executor's automatic PII pipeline (#2243).
@@ -63,7 +65,7 @@ export function createJobsFeature(options = {}) {
         // frequent enough to catch a stuck run soon after it crosses the
         // threshold, cheap enough that an (almost always empty) result set
         // doesn't matter.
-        r.job("stale-run-sweep", { trigger: { cron: "0 * * * *" }, concurrency: "skip" }, createStaleRunSweepJob(staleRunTimeoutHours));
+        r.job("stale-run-sweep", { trigger: { cron: "0 * * * *" }, concurrency: "skip" }, createStaleRunSweepJob(staleRunTimeoutHours, retentionDays));
         const handlers = {
             trigger: r.writeHandler(triggerWrite),
             retry: r.writeHandler(retryWrite),

package/dist/jobs/handlers/list.query.js

@@ -7,6 +7,8 @@ import { decryptStoredPii, mapWithConcurrency } from "../../shared/index.js";
 import { jobRunsTable } from "../job-run-table.js";
 const KMS_POOL_CONCURRENCY = 4;
 const DEFAULT_PAGE_SIZE = 50;
+// The offset cursor re-reads everything up to the page end, so the page size bounds that read.
+const MAX_LIST_LIMIT = 200;
 const jobRunStatusSchema = z.enum(["queued", "running", "completed", "failed"]);
 async function decryptRunRow(row) {
     let result = row;
@@ -56,7 +58,7 @@ export const listQuery = defineQueryHandler({
             .optional(),
         sort: z.enum(["jobName", "status", "startedAt", "duration"]).optional(),
         sortDirection: z.enum(["asc", "desc"]).optional(),
-        limit: z.number().int().min(1).optional(),
+        limit: z.number().int().min(1).max(MAX_LIST_LIMIT).optional(),
         cursor: z.string().optional(),
         totalCount: z.boolean().optional(),
     }),

package/dist/jobs/handlers/retry.write.d.ts

@@ -5,4 +5,4 @@ export declare const retryWrite: import("@cosmicdrift/kumiko-types/define-handle
     jobName: string;
     bullJobId: string;
     retriedFromRunId: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/jobs/handlers/stale-run-sweep.job.d.ts

@@ -1,3 +1,3 @@
 import type { JobHandlerFn } from "@cosmicdrift/kumiko-framework/engine";
 export declare const DEFAULT_JOB_RUN_STALE_TIMEOUT_HOURS = 24;
-export declare function createStaleRunSweepJob(timeoutHours: number): JobHandlerFn;
+export declare function createStaleRunSweepJob(timeoutHours: number, queuedRetentionDays: number): JobHandlerFn;

package/dist/jobs/handlers/stale-run-sweep.job.js

@@ -9,7 +9,7 @@ import { markStaleJobRunsFailed } from "../db/queries/stale-run-sweep.js";
 // default has to clear any plausible real job, not just be "long".
 // Configurable per-app via JobsFeatureOptions.staleRunTimeoutHours.
 export const DEFAULT_JOB_RUN_STALE_TIMEOUT_HOURS = 24;
-export function createStaleRunSweepJob(timeoutHours) {
+export function createStaleRunSweepJob(timeoutHours, queuedRetentionDays) {
     return async (_payload, ctx) => {
         if (!ctx.systemDb) {
             throw new InternalError({
@@ -17,7 +17,7 @@ export function createStaleRunSweepJob(timeoutHours) {
             });
         }
         const db = ctx.systemDb.unsafeRaw("stale-run sweep marks stuck runs of every tenant as failed"); // @cast-boundary db-operator — DbRunner narrows to DbConnection, jobs never run inside a DbTx
-        const result = await markStaleJobRunsFailed(db, timeoutHours);
+        const result = await markStaleJobRunsFailed(db, timeoutHours, queuedRetentionDays);
         ctx.log?.info?.(`[jobs:stale-run-sweep] complete: ${JSON.stringify(result)}`);
     };
 }

package/dist/jobs/handlers/trigger.write.d.ts

@@ -5,4 +5,4 @@ export declare const triggerWrite: import("@cosmicdrift/kumiko-types/define-hand
 }, z.core.$strip>, {
     jobName: string;
     bullJobId: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/jobs/job-run-logger.js

@@ -103,6 +103,7 @@ async function encryptStartedPayload(payload, triggeredById) {
 const TENANT_JOB_FAILURE_LOCK_NAMESPACE = 0x746a666c;
 // 'tjrl': serialises the finished-row write + prune per tenant run key.
 const TENANT_JOB_RUN_LOCK_NAMESPACE = 0x746a726c;
+const TENANT_RUN_CONFLICT_KEYS = ["tenantId", "jobName", "bullJobId"];
 // fw#3079 — which row the tenant-visible failure record lives in: one per
 // (tenant, job, subject), so the next outcome of the same work replaces or
 // clears it. `subject` is null for a job that declares no subjectFields.
@@ -156,9 +157,22 @@ async function recordTenantRunQueued(db, jobName, bullJobId, meta) {
     if (!key)
         return;
     const now = Temporal.Now.instant();
-    // DO NOTHING: a fast worker can report the start before this enqueue hook
-    // returns, and a repeated jobId (debounce, fan-out dedup) is the same job.
-    await insertOnConflictDoNothing(db, tenantJobRunsTable, { ...key, bullJobId, status: "queued", queuedAt: now, updatedAt: now }, { conflictKeys: ["bullJobId"] });
+    await transaction(db, async (tx) => {
+        // A finished row under the same id is left over from before a Redis reset
+        // (ids restart at 1), not this job. Only rows that went through this hook
+        // (queuedAt set) qualify: a fast worker can finish before the hook runs,
+        // and that row is this job's own and must stay.
+        await deleteMany(tx, tenantJobRunsTable, {
+            tenantId: key.tenantId,
+            jobName,
+            bullJobId,
+            status: { in: ["completed", "failed"] },
+            queuedAt: { gt: Temporal.Instant.fromEpochMilliseconds(0) },
+        });
+        // DO NOTHING: a fast worker can report the start before this enqueue hook
+        // returns, and a repeated jobId (debounce, fan-out dedup) is the same job.
+        await insertOnConflictDoNothing(tx, tenantJobRunsTable, { ...key, bullJobId, status: "queued", queuedAt: now, updatedAt: now }, { conflictKeys: [...TENANT_RUN_CONFLICT_KEYS] });
+    });
 }
 async function recordTenantRunStarted(db, jobName, bullJobId, meta) {
     // skip: job did not opt in to tenantVisibleRun
@@ -170,7 +184,7 @@ async function recordTenantRunStarted(db, jobName, bullJobId, meta) {
         return;
     const now = Temporal.Now.instant();
     await upsertOnConflict(db, tenantJobRunsTable, { ...key, bullJobId, status: "running", startedAt: now, updatedAt: now }, {
-        conflictKeys: ["bullJobId"],
+        conflictKeys: [...TENANT_RUN_CONFLICT_KEYS],
         update: { status: "running", startedAt: now, finishedAt: null, updatedAt: now },
     });
 }
@@ -186,7 +200,7 @@ async function recordTenantRunOutcome(db, jobName, bullJobId, outcome, result) {
     // A failed attempt BullMQ will retry goes back to waiting: the tenant keeps
     // seeing pending work, not a failure the next attempt may still resolve.
     if (result === "failed" && !outcome.finalAttempt) {
-        await updateMany(db, tenantJobRunsTable, { status: "queued", startedAt: null, finishedAt: null, updatedAt: now }, { bullJobId });
+        await updateMany(db, tenantJobRunsTable, { status: "queued", startedAt: null, finishedAt: null, updatedAt: now }, { tenantId: key.tenantId, jobName, bullJobId });
         // skip: retry pending, the row stays active until the final attempt
         return;
     }
@@ -196,7 +210,10 @@ async function recordTenantRunOutcome(db, jobName, bullJobId, outcome, result) {
     // both behind.
     await transaction(db, async (tx) => {
         await acquireNamespacedAdvisoryLock(tx, TENANT_JOB_RUN_LOCK_NAMESPACE, JSON.stringify([key.tenantId, key.jobName, key.subject]));
-        await upsertOnConflict(tx, tenantJobRunsTable, { ...key, bullJobId, status: result, finishedAt: now, updatedAt: now }, { conflictKeys: ["bullJobId"], update: { status: result, finishedAt: now, updatedAt: now } });
+        await upsertOnConflict(tx, tenantJobRunsTable, { ...key, bullJobId, status: result, finishedAt: now, updatedAt: now }, {
+            conflictKeys: [...TENANT_RUN_CONFLICT_KEYS],
+            update: { status: result, finishedAt: now, updatedAt: now },
+        });
         await deleteMany(tx, tenantJobRunsTable, {
             ...key,
             status: { in: ["completed", "failed"] },
@@ -204,8 +221,13 @@ async function recordTenantRunOutcome(db, jobName, bullJobId, outcome, result) {
         });
     });
 }
-async function dropTenantRunQueued(db, bullJobId) {
-    await deleteMany(db, tenantJobRunsTable, { bullJobId, status: "queued" });
+async function dropTenantRunQueued(db, jobName, bullJobId, meta) {
+    await deleteMany(db, tenantJobRunsTable, {
+        tenantId: meta.tenantId,
+        jobName,
+        bullJobId,
+        status: "queued",
+    });
 }
 const log = createFallbackLogger("job-run-logger");
 // The tenant run state is an optional side write: a throw here must not
@@ -287,8 +309,8 @@ export function createJobRunLogger(opts) {
         onJobQueued: async (jobName, bullJobId, meta) => {
             await isolateTenantRunWrite(() => recordTenantRunQueued(db, jobName, bullJobId, meta), jobName, bullJobId);
         },
-        onJobDropped: async (jobName, bullJobId) => {
-            await isolateTenantRunWrite(() => dropTenantRunQueued(db, bullJobId), jobName, bullJobId);
+        onJobDropped: async (jobName, bullJobId, meta) => {
+            await isolateTenantRunWrite(() => dropTenantRunQueued(db, jobName, bullJobId, meta), jobName, bullJobId);
         },
         onJobStart: async (jobName, bullJobId, meta) => {
             await isolateTenantRunWrite(() => recordTenantRunStarted(db, jobName, bullJobId, meta), jobName, bullJobId);

package/dist/jobs/tenant-job-run-table.js

@@ -8,7 +8,7 @@ import { index, instant, table as pgTable, serial, sql, text, uniqueIndex, uuid,
 // job is invisible there. This table holds no payload, error text or logs by
 // design — the tenant learns only that work is waiting, running or finished.
 //
-// One row per BullMQ job. Active rows (queued/running) are kept as they are;
+// One row per BullMQ job and (tenant, job name). Active rows (queued/running) are kept as they are;
 // a finished row replaces earlier finished rows of the same (tenant, job,
 // subject), so only the latest outcome stays. `subject` is the canonical JSON
 // of the job's declared subjectFields, or NULL for none — stored in clear, so
@@ -25,7 +25,8 @@ export const tenantJobRunsTable = pgTable("store_tenant_job_runs", {
     finishedAt: instant("finished_at"),
     updatedAt: instant("updated_at").default(sql `now()`).notNull(),
 }, (t) => [
-    uniqueIndex("store_tenant_job_runs_bull_job_id_unique").on(t.bullJobId),
+    // BullMQ ids are unique per queue only; the id alone would let two tenants collide.
+    uniqueIndex("store_tenant_job_runs_tenant_job_bull_job_id_unique").on(t.tenantId, t.jobName, t.bullJobId),
     // Finishing a run prunes older outcomes by this key; the tenant query reads by it.
     index("store_tenant_job_runs_tenant_job_subject_idx").on(t.tenantId, t.jobName, t.subject),
     // Stale sweep and retention filter on age alone.

package/dist/ledger/entity.js

@@ -160,7 +160,9 @@ export const scheduleEntity = createEntity({
     },
     // Find-then-create by sourceRef races across tabs/devices; only the DB closes
     // that gap. Partial because sourceRef is optional. A new name (not the old
-    // non-unique default) keeps the migration an in-place CREATE UNIQUE INDEX.
+    // non-unique default) keeps the migration an in-place CREATE UNIQUE INDEX;
+    // that statement, like a projection rebuild, fails on existing duplicate
+    // (tenant_id, source_ref) pairs, so duplicates must be cleaned up beforehand.
     indexes: [
         { columns: ["tenantId", "subjectType", "subjectId"] },
         {

package/dist/managed-pages/handlers/set.write.d.ts

@@ -12,4 +12,4 @@ export declare const setWrite: import("@cosmicdrift/kumiko-types/define-handler"
     slug: string;
     lang: string;
     isNew: boolean;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/personal-access-tokens/handlers/create.write.d.ts

@@ -17,4 +17,4 @@ export declare function createPatCreateHandler(opts?: CreatePatOptions): import(
     id: string;
     token: string;
     prefix: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/personal-access-tokens/handlers/revoke.write.d.ts

@@ -3,4 +3,4 @@ export declare const revokePatWrite: import("@cosmicdrift/kumiko-types/define-ha
     id: z.ZodUUID;
 }, z.core.$strip>, {
     id: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/renderer-foundation/types.d.ts

@@ -48,6 +48,8 @@ export type RenderResponse = ({
     html: string;
     text: string;
     previewText?: string;
+    fromName?: string;
+    replyTo?: string;
     attachments?: readonly MailAttachmentRef[];
 } | {
     kind: "document-pdf";