@cosmicdrift/kumiko-bundled-features 0.364.0 → 0.365.0

package/dist/data-retention/run-retention-cleanup.js

@@ -40,7 +40,7 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { collectPiiSubjectFields, configuredPiiSubjectKms, isSelfPiiField, resolveSubjectForField, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
 import { createEventStoreExecutor, createTenantDb, nullBlindIndexesForSubject, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
-import { deleteStoredFileAndDerivatives } from "@cosmicdrift/kumiko-framework/derivatives";
+import { deleteFileRefBytes } from "@cosmicdrift/kumiko-framework/derivatives";
 import { createSystemUser, entityHasAnonymizableSubjectField, } from "@cosmicdrift/kumiko-framework/engine";
 import { fileRefEntity, fileRefsTable, } from "@cosmicdrift/kumiko-framework/files";
 import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
@@ -250,9 +250,9 @@ async function isFileRefSharedByOtherRow(db, holders, ownTable, tenantId, rowId,
 }
 // Throws (unsafe key, missing list permission) must fail this row closed,
 // not abort the whole tenant run.
-async function deleteFileFailingClosed(key, store, logContext) {
+async function deleteFileFailingClosed(key, files, logContext) {
     try {
-        return await deleteStoredFileAndDerivatives(key, store, "data-retention:hardDelete");
+        return await deleteFileRefBytes(files, { storageKey: key }, "data-retention:hardDelete");
     }
     catch (err) {
         // biome-ignore lint/suspicious/noConsole: operator-visibility for storage-cleanup failures
@@ -304,13 +304,12 @@ async function purgeHardDeleteRowWithFiles(args) {
         return false;
     }
     const files = args.files;
-    const store = { list: files.list, delete: (key) => files.ref(key).delete() };
     let anyFailed = false;
     for (const fileRef of toDelete) {
         const key = fileRef["storageKey"];
         if (typeof key !== "string" || key.length === 0)
             continue;
-        const failedKeys = await deleteFileFailingClosed(key, store, `tenant=${args.tenantId} entity=${args.entityName} row=${rowId}`);
+        const failedKeys = await deleteFileFailingClosed(key, files, `tenant=${args.tenantId} entity=${args.entityName} row=${rowId}`);
         if (failedKeys.length > 0) {
             anyFailed = true;
             // biome-ignore lint/suspicious/noConsole: operator-visibility for storage-cleanup failures

package/dist/delivery/attachment-ref.js

@@ -33,13 +33,28 @@ export const fileAttachmentRefSchema = z
     fileName: attachmentFileNameSchema,
 })
     .strict();
+// BigInt values and cycles make JSON.stringify throw; that must surface as a validation issue,
+// not a raw TypeError that a retrying job hits again on the same data.
+function isJsonSerializable(value) {
+    try {
+        JSON.stringify(value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function jsonByteLength(value) {
+    return new TextEncoder().encode(JSON.stringify(value)).byteLength;
+}
 export const renderedPdfAttachmentRefSchema = z
     .object({
     kind: z.literal("rendered-pdf"),
     templateSlug: templateSlugSchema,
     variables: z
         .record(z.string(), z.unknown())
-        .refine((value) => Buffer.byteLength(JSON.stringify(value)) <= MAX_RENDERED_PDF_VARIABLES_BYTES, {
+        .refine(isJsonSerializable, { message: "variables must be JSON-serializable" })
+        .refine((value) => !isJsonSerializable(value) || jsonByteLength(value) <= MAX_RENDERED_PDF_VARIABLES_BYTES, {
         message: `variables must not exceed ${MAX_RENDERED_PDF_VARIABLES_BYTES} bytes as JSON`,
     }),
     fileName: attachmentFileNameSchema.refine((name) => name.toLowerCase().endsWith(".pdf"), {

package/dist/delivery/delivery-service.js

@@ -79,11 +79,20 @@ export function createDeliveryService(options) {
     }
     // A key that guarded nothing must not turn the caller's retry into a skipped duplicate.
     // Partial success keeps it: a retry would re-send to those who got it.
-    async function releaseIdempotencyIfNothingDelivered(tenantId, key, run) {
+    // A failing release is logged and swallowed: it must neither replace the dispatch error the
+    // caller retries on nor fail a notify() that already dispatched.
+    async function releaseIdempotencyIfNothingDelivered(tenantId, key, run, notificationType) {
         // skip: no key claimed, or a recipient already got the notification
         if (!key || run.deliveries.some(isDeliveredOrQueued))
             return;
-        await idemRedis?.del(deliveryIdempotencyRedisKey(tenantId, key));
+        try {
+            await idemRedis?.del(deliveryIdempotencyRedisKey(tenantId, key));
+        }
+        catch (releaseErr) {
+            logError.warn(`idempotency key release failed: ${redactedMessageOf(releaseErr)}`, {
+                notificationType,
+            });
+        }
     }
     // Only a single-channel route lets the queued job free the key on terminal failure
     // without risking a duplicate send on another channel.
@@ -290,35 +299,50 @@ export function createDeliveryService(options) {
         return addressHash !== undefined && suppressed.has(addressOptOutKey(addressHash, channelName));
     }
     const recipientChannelKey = (userId, channelName) => `${userId}|${channelName}`;
-    async function isChannelDeliverable(run, userId, tenantId, notificationType, channelName) {
-        if (isChannelKilled && (await isChannelKilled(tenantId, channelName)))
-            return false;
-        return isChannelEnabled(run, userId, tenantId, notificationType, channelName);
+    // Kill switch, then the user's preference, then the rate limit — the order deliverToUser reports
+    // skips in. The rate limit consumes a token, so each recipient/channel pair is evaluated once.
+    async function evaluateChannelGate(run, userId, tenantId, notificationType, channelName, priority) {
+        if (isChannelKilled && (await isChannelKilled(tenantId, channelName))) {
+            return "channel_disabled";
+        }
+        // Critical priority skips the preference check
+        if (priority !== "critical" &&
+            !(await isChannelEnabled(run, userId, tenantId, notificationType, channelName))) {
+            return "preference_disabled";
+        }
+        if (rateLimit && !(await checkRateLimit(rateLimit, tenantId, channelName))) {
+            return "rate_limited";
+        }
+        return "open";
     }
     // Resolves every user's channel addresses up front so the opt-out lookup can
-    // cover them all at once. A resolve that throws stays out of the map: the
-    // delivery loop resolves it again and reports channel_error as before.
-    // Channels the kill switch or the user's preferences disable are never resolved
-    // here: resolve may have side effects and deliverToUser skips those channels.
-    async function prefetchUserAddresses(run, userIds, tenantId, notificationType) {
+    // cover them all at once. A resolve that throws stays out of the address map:
+    // the delivery loop resolves it again and reports channel_error as before.
+    // Channels that are gated (kill switch, preferences, rate limit) are never resolved
+    // here: resolve may have side effects and deliverToUser skips those channels. The
+    // gate verdict is kept so deliverToUser does not query it a second time.
+    async function prefetchRecipients(run, userIds, tenantId, notificationType, priority) {
         const addresses = new Map();
+        const gates = new Map();
         const channelCtx = buildChannelContext(run.db, registry, sseBroker, tenantId, secrets, tenantConfigFor?.(tenantId), run.filesForTenant);
         for (const userId of userIds) {
             for (const channel of channels) {
                 if (!channel.resolve)
                     continue;
+                const key = recipientChannelKey(userId, channel.name);
                 try {
-                    if (!(await isChannelDeliverable(run, userId, tenantId, notificationType, channel.name))) {
+                    const gate = await evaluateChannelGate(run, userId, tenantId, notificationType, channel.name, priority);
+                    gates.set(key, gate);
+                    if (gate !== "open")
                         continue;
-                    }
-                    addresses.set(recipientChannelKey(userId, channel.name), await channel.resolve(userId, channelCtx));
+                    addresses.set(key, await channel.resolve(userId, channelCtx));
                 }
                 catch {
                     // skip: re-resolved (and logged) by deliverToUser
                 }
             }
         }
-        return addresses;
+        return { addresses, gates };
     }
     // Check if user has disabled this notification+channel combo.
     // Specificity order: exact > any wildcard. When only wildcards match and they
@@ -341,68 +365,33 @@ export function createDeliveryService(options) {
         // and conservative — DB ordering no longer decides the outcome).
         return !prefs.some((p) => p.enabled === false);
     }
-    async function deliverToUser(userId, notificationType, data, tenantId, priority, run, prefetchedAddresses, suppressed) {
+    async function deliverToUser(userId, notificationType, data, tenantId, priority, run, prefetched, suppressed) {
         const channelCtx = buildChannelContext(run.db, registry, sseBroker, tenantId, secrets, tenantConfigFor?.(tenantId), run.filesForTenant);
         for (const channel of channels) {
             // Route-only channel (no per-user address): not a user-notification target.
             if (!channel.resolve)
                 continue;
             const message = buildMessage(notificationType, data, channel.name, run.locale);
-            // Kill switch: tenant admin disabled this channel entirely
-            if (isChannelKilled) {
-                const killed = await isChannelKilled(tenantId, channel.name);
-                if (killed) {
-                    await logDelivery(run, {
-                        tenantId,
-                        notificationType,
-                        channel: channel.name,
-                        recipientId: userId,
-                        recipientAddress: null,
-                        status: "skipped",
-                        error: "channel_disabled",
-                        priority,
-                    });
-                    continue;
-                }
-            }
-            // Check preferences (critical priority skips preference check)
-            if (priority !== "critical") {
-                const enabled = await isChannelEnabled(run, userId, tenantId, notificationType, channel.name);
-                if (!enabled) {
-                    await logDelivery(run, {
-                        tenantId,
-                        notificationType,
-                        channel: channel.name,
-                        recipientId: userId,
-                        recipientAddress: null,
-                        status: "skipped",
-                        error: "preference_disabled",
-                        priority,
-                    });
-                    continue;
-                }
-            }
-            // Rate limiting
-            if (rateLimit) {
-                const allowed = await checkRateLimit(rateLimit, tenantId, channel.name);
-                if (!allowed) {
-                    await logDelivery(run, {
-                        tenantId,
-                        notificationType,
-                        channel: channel.name,
-                        recipientId: userId,
-                        recipientAddress: null,
-                        status: "skipped",
-                        error: "rate_limited",
-                        priority,
-                    });
-                    continue;
-                }
+            const prefetchKey = recipientChannelKey(userId, channel.name);
+            const gate = prefetched.gates.get(prefetchKey) ??
+                (await evaluateChannelGate(run, userId, tenantId, notificationType, channel.name, priority));
+            if (gate !== "open") {
+                await logDelivery(run, {
+                    tenantId,
+                    notificationType,
+                    channel: channel.name,
+                    recipientId: userId,
+                    recipientAddress: null,
+                    status: "skipped",
+                    error: gate,
+                    priority,
+                });
+                continue;
             }
             try {
-                const prefetchKey = recipientChannelKey(userId, channel.name);
-                const address = prefetchedAddresses.has(prefetchKey)
-                    ? prefetchedAddresses.get(prefetchKey)
+                const wasPrefetched = prefetched.addresses.has(prefetchKey);
+                const address = wasPrefetched
+                    ? prefetched.addresses.get(prefetchKey)
                     : await channel.resolve(userId, channelCtx);
                 if (!address) {
                     await logDelivery(run, {
@@ -417,7 +406,12 @@ export function createDeliveryService(options) {
                     });
                     continue;
                 }
-                if (priority !== "critical" && isAddressSuppressed(suppressed, address, channel.name)) {
+                // A fallback resolve yields an address the batched opt-out lookup never covered.
+                const suppressedForAddress = wasPrefetched
+                    ? suppressed
+                    : await loadSuppressedAddresses(run, tenantId, notificationType, priority, [address]);
+                if (priority !== "critical" &&
+                    isAddressSuppressed(suppressedForAddress, address, channel.name)) {
                     await logDelivery(run, {
                         tenantId,
                         notificationType,
@@ -551,12 +545,12 @@ export function createDeliveryService(options) {
             else {
                 userIds = to;
             }
-            const prefetchedAddresses = priority === "critical"
-                ? new Map()
-                : await prefetchUserAddresses(run, userIds, tenantId, notificationType);
-            const suppressed = await loadSuppressedAddresses(run, tenantId, notificationType, priority, [...prefetchedAddresses.values()].filter((address) => !!address));
+            const prefetched = priority === "critical"
+                ? { addresses: new Map(), gates: new Map() }
+                : await prefetchRecipients(run, userIds, tenantId, notificationType, priority);
+            const suppressed = await loadSuppressedAddresses(run, tenantId, notificationType, priority, [...prefetched.addresses.values()].filter((address) => !!address));
             for (const userId of userIds) {
-                await deliverToUser(userId, notificationType, data, tenantId, priority, run, prefetchedAddresses, suppressed);
+                await deliverToUser(userId, notificationType, data, tenantId, priority, run, prefetched, suppressed);
             }
         }
     }
@@ -599,15 +593,10 @@ export function createDeliveryService(options) {
                 await dispatchNotification(notificationType, options, tenantId, priority, run);
             }
             catch (err) {
-                // A failing release must not replace the dispatch error the caller retries on.
-                await releaseIdempotencyIfNothingDelivered(tenantId, idempotencyKey, run).catch((releaseErr) => {
-                    logError.warn(`idempotency key release failed: ${redactedMessageOf(releaseErr)}`, {
-                        notificationType,
-                    });
-                });
+                await releaseIdempotencyIfNothingDelivered(tenantId, idempotencyKey, run, notificationType);
                 throw err;
             }
-            await releaseIdempotencyIfNothingDelivered(tenantId, idempotencyKey, run);
+            await releaseIdempotencyIfNothingDelivered(tenantId, idempotencyKey, run, notificationType);
             return dispatched(run);
         },
     };

package/dist/feature-toggles/toggle-runtime.d.ts

@@ -1,6 +1,6 @@
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { type Registry } from "@cosmicdrift/kumiko-framework/engine";
-import { type ClosableCacheSyncBus } from "@cosmicdrift/kumiko-framework/redis";
+import { type CacheSyncBus, type ClosableCacheSyncBus } from "@cosmicdrift/kumiko-framework/redis";
 export type ToggleSyncSignal = {
     publish(featureName: string, enabled: boolean): void;
     onMessage(listener: (featureName: string, enabled: boolean) => void): void;
@@ -12,14 +12,16 @@ export declare class GlobalFeatureToggleRuntime {
     private readonly syncSignal?;
     private readonly ownedBus?;
     private snapshot;
-    private appliedDuringLoad;
+    private readonly pendingFlipBuffers;
+    private loadInFlight;
     constructor(db: DbConnection, registry: Registry, syncSignal?: ToggleSyncSignal | undefined, ownedBus?: ClosableCacheSyncBus | undefined);
     close(): Promise<void>;
     initialize(): Promise<void>;
+    private loadSnapshot;
     refresh(): Promise<void>;
     apply(featureName: string, enabled: boolean): void;
     broadcastToggle(featureName: string, enabled: boolean): void;
     readOverride(featureName: string): boolean | undefined;
     effectiveFeatures: () => ReadonlySet<string>;
 }
-export declare function createFeatureToggleRuntime(db: DbConnection, registry: Registry, syncSignal?: ToggleSyncSignal): Promise<GlobalFeatureToggleRuntime>;
+export declare function createFeatureToggleRuntime(db: DbConnection, registry: Registry, syncSignal?: ToggleSyncSignal, cacheSyncBus?: CacheSyncBus): Promise<GlobalFeatureToggleRuntime>;

package/dist/feature-toggles/toggle-runtime.js

@@ -22,9 +22,11 @@ export class GlobalFeatureToggleRuntime {
     syncSignal;
     ownedBus;
     snapshot = new Map();
-    // Flips applied while a snapshot load is in flight. The load's SELECT may have
-    // started before the flip committed, so its rows can be older than these.
-    appliedDuringLoad;
+    // One buffer per requested load, open from the call until its SELECT finished: the SELECT
+    // may have started before a flip committed, so its rows can be older than the flips collected.
+    pendingFlipBuffers = new Set();
+    // Loads run one at a time so the older rows of one cannot overwrite the result of another.
+    loadInFlight = Promise.resolve();
     constructor(db, registry, syncSignal, ownedBus) {
         this.db = db;
         this.registry = registry;
@@ -47,9 +49,14 @@ export class GlobalFeatureToggleRuntime {
     async close() {
         await this.ownedBus?.close();
     }
-    async initialize() {
+    initialize() {
         const pendingFlips = new Map();
-        this.appliedDuringLoad = pendingFlips;
+        this.pendingFlipBuffers.add(pendingFlips);
+        const load = this.loadInFlight.then(() => this.loadSnapshot(pendingFlips));
+        this.loadInFlight = load.catch(() => undefined);
+        return load;
+    }
+    async loadSnapshot(pendingFlips) {
         try {
             const rows = await selectMany(this.db, globalFeatureStateTable);
             this.snapshot = new Map([
@@ -58,7 +65,7 @@ export class GlobalFeatureToggleRuntime {
             ]);
         }
         finally {
-            this.appliedDuringLoad = undefined;
+            this.pendingFlipBuffers.delete(pendingFlips);
         }
     }
     // Re-read the full snapshot. Called from the set-handler after a
@@ -74,7 +81,8 @@ export class GlobalFeatureToggleRuntime {
     // lock. Kept alongside refresh() so both options are explicit.
     apply(featureName, enabled) {
         this.snapshot.set(featureName, enabled);
-        this.appliedDuringLoad?.set(featureName, enabled);
+        for (const pendingFlips of this.pendingFlipBuffers)
+            pendingFlips.set(featureName, enabled);
     }
     // Called by the toggle-cache-sync MSP handler (feature.ts) — the one
     // process whose shared cursor won a given toggle-set event. With a
@@ -116,11 +124,16 @@ export class GlobalFeatureToggleRuntime {
 }
 // Factory for app-boot wiring: instantiate, initialize, return the runtime (for the
 // set-handler to refresh; its effectiveFeatures feeds createDispatcher). Without an explicit
-// syncSignal the runtime builds one on the framework cache-sync bus: Redis-backed when
-// REDIS_URL is set, process-local otherwise. close() releases a bus it created.
-export async function createFeatureToggleRuntime(db, registry, syncSignal) {
-    const ownedBus = syncSignal ? undefined : createDefaultCacheSyncBus();
-    const signal = syncSignal ?? (ownedBus ? createCacheSyncToggleSignal(ownedBus) : undefined);
+// syncSignal the signal runs on the given cacheSyncBus or, failing that, on a bus the runtime
+// creates itself (Redis-backed when REDIS_URL is set, process-local otherwise). close() releases
+// only a bus the runtime created.
+export async function createFeatureToggleRuntime(db, registry, syncSignal, 
+// The server's own bus (the one handed to the dispatcher): reusing it avoids a second set of
+// Redis connections that nothing closes at shutdown.
+cacheSyncBus) {
+    const ownedBus = syncSignal || cacheSyncBus ? undefined : createDefaultCacheSyncBus();
+    const sharedBus = cacheSyncBus ?? ownedBus;
+    const signal = syncSignal ?? (sharedBus ? createCacheSyncToggleSignal(sharedBus) : undefined);
     const runtime = new GlobalFeatureToggleRuntime(db, registry, signal, ownedBus);
     try {
         await runtime.initialize();

package/dist/files-tenant-data/index.d.ts

@@ -1,4 +1,5 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+export declare const FILES_TENANT_DATA_FEATURE: "files-tenant-data";
 export declare function createFilesTenantDataFeature(): FeatureDefinition;
 export { sweepOrphanedDerivativesJob, sweepOrphanedDerivativesPayloadSchema, } from "./handlers/sweep-orphaned-derivatives.job.js";
 export { fileRefStorageDestroyHook, fileRefTenantDestroyHook } from "./hooks.js";

package/dist/files-tenant-data/index.js

@@ -14,8 +14,9 @@ import { defineFeature, EXT_STORAGE_PROVIDER, EXT_TENANT_DATA, } from "@cosmicdr
 import { sweepOrphanedDerivativesJob, sweepOrphanedDerivativesPayloadSchema, } from "./handlers/sweep-orphaned-derivatives.job.js";
 import { fileRefStorageDestroyHook, fileRefTenantDestroyHook } from "./hooks.js";
 const SWEEP_ORPHANED_DERIVATIVES_ESCAPE_HATCH_REASON = "iterates every tenant and checks fileRef owners per tenant";
+export const FILES_TENANT_DATA_FEATURE = "files-tenant-data";
 export function createFilesTenantDataFeature() {
-    return defineFeature("files-tenant-data", (r) => {
+    return defineFeature(FILES_TENANT_DATA_FEATURE, (r) => {
         r.describe("GDPR coverage for the `files` feature's `fileRef` entity: tenant-destroy row purge (EXT_TENANT_DATA) and full storage-prefix binary wipe (EXT_STORAGE_PROVIDER), plus a manual backfill/GC job that sweeps derivatives orphaned by a forget/tenant-destroy that ran before #2461 wired binary cleanup into those flows. Requires `tenant-lifecycle`, optionalRequires `files`.");
         r.uiHints({
             displayLabel: "Files · Tenant-Destroy & Derivative GC",

package/dist/form-draft/db/queries/owned-file-refs.d.ts

@@ -1,4 +1,4 @@
-import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import { type DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 export declare function filterOwnedStorageKeys(db: DbRunner, tenantId: TenantId, ownerId: string, candidateKeys: readonly string[], draftInsertedAt: Temporal.Instant, isCreateMode: boolean): Promise<readonly string[]>;

package/dist/form-draft/db/queries/owned-file-refs.js

@@ -1,4 +1,5 @@
-import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
+import { instantToTimestamptzParam, unsafeReadRetrying, } from "@cosmicdrift/kumiko-framework/bun-db";
+import { toPostgresArrayLiteral } from "@cosmicdrift/kumiko-framework/db";
 // Narrows a draft blob's raw FileRef-shaped storageKeys (collectDraftFileRefKeys
 // output — extracted from free-form, client-supplied JSON, issue #1889) down to
 // the ones with a real, non-deleted file_refs row owned by this exact
@@ -32,6 +33,12 @@ export async function filterOwnedFileRefs(db, tenantId, ownerId, candidateKeys,
     const rows = await unsafeReadRetrying(db, `SELECT "id", "storage_key" FROM "file_refs"
      WHERE "tenant_id" = $1 AND "inserted_by_id" = $2
        AND "storage_key" = ANY($3::text[]) AND "is_deleted" = false
-       AND ($5::boolean OR "inserted_at" > $4::timestamptz)`, [tenantId, ownerId, candidateKeys, draftInsertedAt.toString(), isCreateMode]);
+       AND ($5::boolean OR "inserted_at" > $4::timestamptz)`, [
+        tenantId,
+        ownerId,
+        toPostgresArrayLiteral(candidateKeys),
+        instantToTimestamptzParam(draftInsertedAt),
+        isCreateMode,
+    ]);
     return rows.map((row) => ({ id: row.id, storageKey: row.storage_key }));
 }

package/dist/form-draft/handlers/discard.write.js

@@ -76,7 +76,7 @@ export const discardDraftWrite = defineWriteHandler({
             const schedule = ctx.scheduleAfterCommit;
             const release = async () => {
                 await releaseDraftFileRefs(keys, async (key) => {
-                    await files.ref(key).delete();
+                    await files.refFromFileRef({ storageKey: key }).delete();
                 }, log);
             };
             if (schedule) {

package/dist/jobs/job-run-logger.js

@@ -210,9 +210,12 @@ async function recordTenantRunOutcome(db, jobName, bullJobId, outcome, result) {
     // both behind.
     await transaction(db, async (tx) => {
         await acquireNamespacedAdvisoryLock(tx, TENANT_JOB_RUN_LOCK_NAMESPACE, JSON.stringify([key.tenantId, key.jobName, key.subject]));
-        await upsertOnConflict(tx, tenantJobRunsTable, { ...key, bullJobId, status: result, finishedAt: now, updatedAt: now }, {
+        // Read under the lock: the run that finishes last in lock order must also carry the
+        // latest finishedAt, otherwise a stale timestamp makes it the row that gets pruned.
+        const finishedAt = Temporal.Now.instant();
+        await upsertOnConflict(tx, tenantJobRunsTable, { ...key, bullJobId, status: result, finishedAt, updatedAt: finishedAt }, {
             conflictKeys: [...TENANT_RUN_CONFLICT_KEYS],
-            update: { status: result, finishedAt: now, updatedAt: now },
+            update: { status: result, finishedAt, updatedAt: finishedAt },
         });
         await deleteMany(tx, tenantJobRunsTable, {
             ...key,

package/dist/metrics/filters.d.ts

@@ -3,7 +3,21 @@ import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import type { MetricDefinition, MetricFilterResolver } from "./types.js";
 export declare const RESERVED_PAYLOAD_KEYS: readonly string[];
-export type FilterValueKind = "uuid" | "number" | "string";
+declare const INTEGER_RANGES: {
+    readonly smallint: {
+        readonly min: -32768;
+        readonly max: 32767;
+    };
+    readonly integer: {
+        readonly min: -2147483648;
+        readonly max: 2147483647;
+    };
+    readonly bigint: {
+        readonly min: number;
+        readonly max: number;
+    };
+};
+export type FilterValueKind = "uuid" | "number" | "string" | keyof typeof INTEGER_RANGES;
 /** Undefined = the column type cannot be filtered by a payload value without risking a Postgres cast error. */
 export declare function filterValueKindOf(pgType: string | undefined): FilterValueKind | undefined;
 export type MetricFilterEntry = {
@@ -17,3 +31,4 @@ export declare function metricFilterPayloadShape(metric: MetricDefinition): Reco
 /** Column-equality filters only; resolver filters need resolveMetricFilterWhere. */
 export declare function metricFilterWhere(metric: MetricDefinition, payload: Readonly<Record<string, unknown>>): WhereObject;
 export declare function resolveMetricFilterWhere(metric: MetricDefinition, payload: Readonly<Record<string, unknown>>, ctx: HandlerContext): Promise<WhereObject>;
+export {};

package/dist/metrics/filters.js

@@ -3,17 +3,23 @@ import * as z from "zod";
 export const RESERVED_PAYLOAD_KEYS = ["range", "timeZone", "tenantId"];
 // Dashboard select options always send strings.
 const NUMERIC_STRING = /^-?\d+(\.\d+)?$/;
+const INTEGER_STRING = /^-?\d+$/;
 const MAX_FILTER_STRING_LENGTH = 200;
-const NUMERIC_PG_TYPES = new Set([
-    "integer",
-    "int4",
-    "smallint",
-    "int2",
-    "bigint",
-    "serial",
-    "bigserial",
-    "double precision",
-]);
+const INTEGER_RANGES = {
+    smallint: { min: -32_768, max: 32_767 },
+    integer: { min: -2_147_483_648, max: 2_147_483_647 },
+    // bigint is bound as a JS number, so only the exactly representable range is accepted.
+    bigint: { min: Number.MIN_SAFE_INTEGER, max: Number.MAX_SAFE_INTEGER },
+};
+const PG_INTEGER_KINDS = {
+    smallint: "smallint",
+    int2: "smallint",
+    integer: "integer",
+    int4: "integer",
+    serial: "integer",
+    bigint: "bigint",
+    bigserial: "bigint",
+};
 /** Undefined = the column type cannot be filtered by a payload value without risking a Postgres cast error. */
 export function filterValueKindOf(pgType) {
     if (pgType === undefined)
@@ -22,7 +28,10 @@ export function filterValueKindOf(pgType) {
         return "uuid";
     if (pgType === "text")
         return "string";
-    if (NUMERIC_PG_TYPES.has(pgType) || pgType.startsWith("numeric"))
+    const integerKind = PG_INTEGER_KINDS[pgType];
+    if (integerKind !== undefined)
+        return integerKind;
+    if (pgType === "double precision" || pgType.startsWith("numeric"))
         return "number";
     return undefined;
 }
@@ -31,9 +40,16 @@ export function metricFilterEntries(metric) {
         ? { payloadKey, column: spec }
         : { payloadKey, column: spec.column, resolver: spec });
 }
+function integerValueSchema(range) {
+    const bounded = z.number().int().min(range.min).max(range.max);
+    return z.union([bounded, z.string().regex(INTEGER_STRING).transform(Number).pipe(bounded)]);
+}
 function filterValueSchema(kind) {
     if (kind === "uuid")
         return z.uuid();
+    if (kind === "smallint" || kind === "integer" || kind === "bigint") {
+        return integerValueSchema(INTEGER_RANGES[kind]);
+    }
     if (kind === "number")
         return z.union([z.number(), z.string().regex(NUMERIC_STRING).transform(Number)]);
     return z.string().min(1).max(MAX_FILTER_STRING_LENGTH);

package/dist/personal-access-tokens/revoke-for-user.js

@@ -1,15 +1,10 @@
-import { transaction, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { runnerCanBeginTransaction, transaction, updateMany, } from "@cosmicdrift/kumiko-framework/bun-db";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { append } from "@cosmicdrift/kumiko-framework/event-store";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { PAT_REVOKED_AGGREGATE_TYPE, PAT_REVOKED_EVENT_QN, patRevokedSchema, } from "./pat-revoked-event.js";
 import { apiTokenTable } from "./schema/api-token.js";
-// A pool has begin(); a tx/savepoint handle does not and is already atomic.
-function canBeginTransaction(db) {
-    return typeof propertyOf(db, "begin") === "function";
-}
 // Cross-tenant revoke: password-change and MFA-enable/disable are account-
 // level security events, not scoped to one tenant. Mirrors sessions'
 // sessionMassRevoker (session-callbacks.ts) which passes the boot-time
@@ -17,7 +12,8 @@ function canBeginTransaction(db) {
 export async function revokeAllPatTokensForUser(db, userId) {
     // Update and event commit together: otherwise a failed append leaves the
     // tokens revoked with no event, and a retry matches no live row.
-    return canBeginTransaction(db)
+    // A pool has begin(); a tx/savepoint handle does not and is already atomic.
+    return runnerCanBeginTransaction(db)
         ? transaction(db, (tx) => revokeAndAppend(tx, userId))
         : revokeAndAppend(db, userId);
 }

package/dist/secrets/handlers/delete.write.js

@@ -16,7 +16,9 @@ export function createDeleteHandler(access = DEFAULT_SECRETS_ACCESS) {
         access,
         handler: async (event, ctx) => {
             const secrets = requireSecretsContext(ctx, "secrets:write:delete");
-            const gate = checkSecretKeyWrite(ctx.registry, event.user.roles, event.payload.key);
+            const gate = checkSecretKeyWrite(ctx.registry, event.user.roles, event.payload.key, {
+                allowUndeclared: true,
+            });
             if (!gate.ok)
                 return gate.failure;
             const removed = await secrets.delete(event.user.tenantId, event.payload.key, {

package/dist/secrets/write-gate.d.ts

@@ -7,7 +7,9 @@ export type SecretKeyWriteCheck = {
     readonly ok: false;
     readonly failure: WriteFailure;
 };
-export declare function checkSecretKeyWrite(registry: Registry, userRoles: readonly string[], key: string): SecretKeyWriteCheck;
+export declare function checkSecretKeyWrite(registry: Registry, userRoles: readonly string[], key: string, options?: {
+    readonly allowUndeclared?: boolean;
+}): SecretKeyWriteCheck;
 export type SecretValueSchemaSource = Pick<Registry, "getSecretKey" | "findSecretNamespace">;
 export declare function invalidSecretValueError(): ValidationError;
 export declare function isInvalidSecretValueError(err: unknown): err is ValidationError;

package/dist/secrets/write-gate.js

@@ -15,11 +15,14 @@ function namespaceAcceptsKey(namespace, key) {
 // Only keys declared via r.secret() or under a declared r.secretNamespace()
 // are writable through the API, so a tenant admin cannot plant arbitrary rows
 // next to the feature-owned ones. writeRoles narrows the handler access
-// further for a key or a whole namespace.
-export function checkSecretKeyWrite(registry, userRoles, key) {
+// further for a key or a whole namespace. Delete passes allowUndeclared: it
+// creates nothing, and legacy rows under since-undeclared keys must stay removable.
+export function checkSecretKeyWrite(registry, userRoles, key, options = {}) {
     const keyDef = registry.getSecretKey(key);
     const namespace = keyDef ? undefined : registry.findSecretNamespace(key);
-    if (!keyDef && !(namespace && namespaceAcceptsKey(namespace, key))) {
+    if (!keyDef &&
+        !(namespace && namespaceAcceptsKey(namespace, key)) &&
+        options.allowUndeclared !== true) {
         return unknownKeyFailure(key);
     }
     const writeRoles = keyDef?.writeRoles ?? namespace?.writeRoles;