@cosmicdrift/kumiko-bundled-features 0.377.0 → 0.379.0

package/dist/form-draft/handlers/cleanup.job.js

@@ -74,12 +74,19 @@ export function groupStaleDraftIdsByTenant(batch) {
 // tenant first (see groupStaleDraftIdsByTenant above).
 export async function deleteStaleDraftsBatch(batch, db, retentionDays, log) {
     const deletedRows = [];
+    const deferredIds = [];
     let skippedCount = 0;
     const byId = new Map(batch.map((row) => [row.id, row]));
     for (const [tenantId, ids] of groupStaleDraftIdsByTenant(batch)) {
         const systemUser = createSystemUser(tenantId);
         const tenantDb = createTenantDb({ db, tenantId, mode: "system" });
         for (const id of ids) {
+            // skip: an unreadable blob hides its FileRefs; deleting now would orphan them, so the next run retries.
+            if (byId.get(id)?.draftUnreadable) {
+                log?.warn?.(`[form-draft:cleanup] draft id=${id} tenant=${tenantId} could not be decrypted — kept for the next run`);
+                deferredIds.push(id);
+                continue;
+            }
             // Race: user may have saved between select and here — skip if no longer stale.
             if (!(await isDraftStillStale(db, tenantId, id, retentionDays))) {
                 skippedCount++;
@@ -96,7 +103,7 @@ export async function deleteStaleDraftsBatch(batch, db, retentionDays, log) {
             }
         }
     }
-    return { deletedRows, skippedCount };
+    return { deletedRows, skippedCount, deferredIds };
 }
 export async function cleanupDraftsJob(_payload, ctx, db) {
     const resolved = ctx.configResolver
@@ -112,10 +119,13 @@ export async function cleanupDraftsJob(_payload, ctx, db) {
     const retentionDays = isValidRetention ? resolved : FORM_DRAFT_DEFAULT_RETENTION_DAYS;
     const fileProviderResolver = ctx._fileProviderResolver;
     let deleted = 0;
+    const deferred = new Set();
     while (true) {
         if (ctx.signal?.aborted)
             break;
-        const batch = await selectStaleDraftsBatch(db, retentionDays, DEFAULT_BATCH_SIZE);
+        const batch = await selectStaleDraftsBatch(db, retentionDays, DEFAULT_BATCH_SIZE, [
+            ...deferred,
+        ]);
         if (batch.length === 0)
             break;
         // Rows span arbitrary tenants (this job sweeps the whole table under
@@ -125,7 +135,9 @@ export async function cleanupDraftsJob(_payload, ctx, db) {
         // entirely for rows with no FileRefs in the blob, the common case.
         // Delete first (with staleness re-check), then release binaries from rows
         // that actually disappeared — never release a draft the user just saved.
-        const { deletedRows, skippedCount } = await deleteStaleDraftsBatch(batch, db, retentionDays, ctx.log);
+        const { deletedRows, skippedCount, deferredIds } = await deleteStaleDraftsBatch(batch, db, retentionDays, ctx.log);
+        for (const id of deferredIds)
+            deferred.add(id);
         for (const row of deletedRows) {
             await releaseRowFileRefs(row, db, fileProviderResolver, ctx.log);
         }
@@ -133,7 +145,8 @@ export async function cleanupDraftsJob(_payload, ctx, db) {
         // A skipped row is no longer stale, so the next select drops it — a fully
         // skipped batch still makes progress. Only a batch with neither deletes nor
         // skips (all failed) would reselect the same rows forever.
-        if (deletedRows.length + skippedCount === 0 || batch.length < DEFAULT_BATCH_SIZE)
+        if (deletedRows.length + skippedCount + deferredIds.length === 0 ||
+            batch.length < DEFAULT_BATCH_SIZE)
             break;
     }
     ctx.log?.info?.(`[form-draft:cleanup] deleted=${deleted} retentionDays=${retentionDays}`);

package/dist/form-draft/handlers/discard.write.js

@@ -1,12 +1,12 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { fileRefEntity, fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
-import { FORM_DRAFT_ACCESS } from "../constants.js";
 import { filterOwnedFileRefs } from "../db/queries/owned-file-refs.js";
 import { formDraftExecutor } from "../executor.js";
 import { lookupDraft } from "../lookup.js";
 import { collectDraftFileRefKeys, releaseDraftFileRefs } from "../release-file-refs.js";
 import { discardDraftPayloadSchema } from "../schemas.js";
+import { FORM_DRAFT_ACCESS } from "../web/constants.js";
 // Same construction as file-routes.ts/user-data-rights-defaults' fileRef
 // hook — self-contained (table + entity), no registry needed. `.forget()`
 // hard-deletes the file_refs row via a `fileRef.forgotten` event (rebuild-

package/dist/form-draft/handlers/get.query.js

@@ -1,7 +1,7 @@
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { FORM_DRAFT_ACCESS } from "../constants.js";
 import { lookupDraft } from "../lookup.js";
-import { formDraftBlobSchema, getDraftPayloadSchema } from "../schemas.js";
+import { getDraftPayloadSchema } from "../schemas.js";
+import { FORM_DRAFT_ACCESS } from "../web/constants.js";
 // get — resolves to `{ draft: null }` for both "no draft saved yet" and "a
 // draft exists but belongs to someone else / another tenant" — the lookup
 // is scoped by (tenantId, ownerId, draftKey), so a foreign caller's query
@@ -15,13 +15,12 @@ export const getDraftQuery = defineQueryHandler({
         const row = await lookupDraft(ctx.db, query.user.tenantId, query.user.id, query.payload.draftKey);
         if (!row)
             return { draft: null };
-        const parsed = formDraftBlobSchema.safeParse(row.draft);
-        if (!parsed.success) {
-            // Schema evolution or a corrupt jsonb row: surface it to operators
+        if (!row.draft) {
+            // Schema evolution or a corrupt/erased row: surface it to operators
             // instead of silently making the user's draft vanish.
-            ctx.log?.warn?.(`[form-draft:get] stored blob for draftKey=${query.payload.draftKey} failed schema, treating as absent: ${parsed.error.message}`);
+            ctx.log?.warn?.(`[form-draft:get] stored blob for draftKey=${query.payload.draftKey} failed schema or decryption, treating as absent`);
             return { draft: null };
         }
-        return { draft: parsed.data };
+        return { draft: row.draft };
     },
 });

package/dist/form-draft/handlers/list.query.js

@@ -1,7 +1,7 @@
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { FORM_DRAFT_ACCESS } from "../constants.js";
 import { listDraftsByScreen } from "../lookup.js";
 import { listDraftsPayloadSchema } from "../schemas.js";
+import { FORM_DRAFT_ACCESS } from "../web/constants.js";
 // Two saves landing in the same millisecond tie on savedAt — there's no
 // knowable "true" order between them, so `id` only buys a deterministic,
 // repeatable result, not chronological accuracy.
@@ -20,12 +20,16 @@ export const listDraftsQuery = defineQueryHandler({
     handler: async (query, ctx) => {
         const rows = await listDraftsByScreen(ctx.db, query.user.tenantId, query.user.id, query.payload.screenId);
         const drafts = rows
-            .map((row) => ({
-            id: row.id,
-            draftKey: row.draftKey,
-            stepIndex: row.draft.stepIndex,
-            savedAt: row.draft.savedAt,
-        }))
+            .flatMap((row) => row.draft
+            ? [
+                {
+                    id: row.id,
+                    draftKey: row.draftKey,
+                    stepIndex: row.draft.stepIndex,
+                    savedAt: row.draft.savedAt,
+                },
+            ]
+            : [])
             .sort(byNewestFirst)
             // Matches listDraftsByScreen selectMany limit — JS sort cannot push the
             // ceiling into SQL while savedAt lives inside jsonb.

package/dist/form-draft/handlers/save.write.js

@@ -1,11 +1,11 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { failUnprocessable } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
-import { FORM_DRAFT_ACCESS, FORM_DRAFT_MAX_PER_OWNER, FORM_DRAFT_UNIQUE_KEY_CONSTRAINT, } from "../constants.js";
 import { countDraftsByOwner } from "../db/queries/draft-count.js";
 import { formDraftExecutor } from "../executor.js";
 import { lookupDraft } from "../lookup.js";
 import { saveDraftPayloadSchema } from "../schemas.js";
+import { FORM_DRAFT_ACCESS, FORM_DRAFT_MAX_PER_OWNER, FORM_DRAFT_UNIQUE_KEY_CONSTRAINT, } from "../web/constants.js";
 /**
  * save is an upsert keyed on (tenantId, ownerId, draftKey) — same
  * lookup-then-create|update-with-race-retry idiom as

package/dist/form-draft/index.d.ts

@@ -1,4 +1,3 @@
-export { FORM_DRAFT_ACCESS, FORM_DRAFT_FEATURE_NAME, FORM_DRAFT_KEY_MAX_LENGTH, FORM_DRAFT_UNIQUE_KEY_CONSTRAINT, FormDraftHandlers, FormDraftQueries, } from "./constants.ts";
 export { formDraftEntity } from "./entity.ts";
 export { formDraftExecutor, formDraftTable } from "./executor.ts";
 export { createFormDraftFeature } from "./feature.ts";
@@ -8,3 +7,4 @@ export { type ListDraftsResult, listDraftsQuery } from "./handlers/list.query.ts
 export { saveDraftWrite } from "./handlers/save.write.ts";
 export { type FormDraftRow, lookupDraft } from "./lookup.ts";
 export { type DiscardDraftPayload, discardDraftPayloadSchema, type FormDraftBlob, formDraftBlobSchema, type GetDraftPayload, getDraftPayloadSchema, type ListDraftsPayload, listDraftsPayloadSchema, type SaveDraftPayload, saveDraftPayloadSchema, } from "./schemas.ts";
+export { FORM_DRAFT_ACCESS, FORM_DRAFT_FEATURE_NAME, FORM_DRAFT_KEY_MAX_LENGTH, FORM_DRAFT_UNIQUE_KEY_CONSTRAINT, FormDraftHandlers, FormDraftQueries, } from "./web/constants.ts";

package/dist/form-draft/index.js

@@ -1,4 +1,3 @@
-export { FORM_DRAFT_ACCESS, FORM_DRAFT_FEATURE_NAME, FORM_DRAFT_KEY_MAX_LENGTH, FORM_DRAFT_UNIQUE_KEY_CONSTRAINT, FormDraftHandlers, FormDraftQueries, } from "./constants.js";
 export { formDraftEntity } from "./entity.js";
 export { formDraftExecutor, formDraftTable } from "./executor.js";
 export { createFormDraftFeature } from "./feature.js";
@@ -8,3 +7,4 @@ export { listDraftsQuery } from "./handlers/list.query.js";
 export { saveDraftWrite } from "./handlers/save.write.js";
 export { lookupDraft } from "./lookup.js";
 export { discardDraftPayloadSchema, formDraftBlobSchema, getDraftPayloadSchema, listDraftsPayloadSchema, saveDraftPayloadSchema, } from "./schemas.js";
+export { FORM_DRAFT_ACCESS, FORM_DRAFT_FEATURE_NAME, FORM_DRAFT_KEY_MAX_LENGTH, FORM_DRAFT_UNIQUE_KEY_CONSTRAINT, FormDraftHandlers, FormDraftQueries, } from "./web/constants.js";

package/dist/form-draft/lookup.d.ts

@@ -5,13 +5,13 @@ import type { FormDraftBlob } from "./schemas.ts";
 export type FormDraftRow = {
     readonly id: string;
     readonly version: number;
-    readonly draft: FormDraftBlob;
+    readonly draft: FormDraftBlob | null;
     readonly insertedAt: Temporal.Instant;
 };
 export declare function lookupDraft(db: TenantDb, tenantId: TenantId, ownerId: string, draftKey: string): Promise<FormDraftRow | undefined>;
 export type FormDraftSummaryRow = {
     readonly id: string;
     readonly draftKey: string;
-    readonly draft: FormDraftBlob;
+    readonly draft: FormDraftBlob | null;
 };
 export declare function listDraftsByScreen(db: TenantDb, tenantId: TenantId, ownerId: string, screenId: string): Promise<readonly FormDraftSummaryRow[]>;

package/dist/form-draft/lookup.js

@@ -1,10 +1,14 @@
 import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
+import { readStoredDraft } from "./decrypt-draft.js";
 import { formDraftTable } from "./executor.js";
 // Shared by save (upsert lookup + race re-lookup), discard, and get — always
 // scoped by tenantId + ownerId + draftKey, tenantId included explicitly
 // (not relying on TenantDb auto-scoping) to mirror delivery/upsert-preference.ts.
 export async function lookupDraft(db, tenantId, ownerId, draftKey) {
-    return fetchOne(db, formDraftTable, { tenantId, ownerId, draftKey });
+    const row = await fetchOne(db, formDraftTable, { tenantId, ownerId, draftKey });
+    if (!row)
+        return undefined;
+    return { ...row, draft: await readStoredDraft(row.draft) };
 }
 // LIKE metacharacters in a caller-controlled screenId must not widen the
 // prefix scan (e.g. a literal "%" matching every draft).
@@ -19,9 +23,10 @@ function escapeLikePattern(value) {
 export async function listDraftsByScreen(db, tenantId, ownerId, screenId) {
     // ponytail: hard cap — savedAt lives in jsonb so SQL ORDER BY+LIMIT is wrong;
     // promote savedAt to a column when callers need correct newest-N under the ceiling.
-    return selectMany(db, formDraftTable, {
+    const rows = await selectMany(db, formDraftTable, {
         tenantId,
         ownerId,
         draftKey: { like: `${escapeLikePattern(screenId)}:%` },
     }, { limit: 200 });
+    return Promise.all(rows.map(async (row) => ({ ...row, draft: await readStoredDraft(row.draft) })));
 }

package/dist/form-draft/schemas.js

@@ -1,5 +1,5 @@
 import * as z from "zod";
-import { FORM_DRAFT_KEY_MAX_LENGTH, FORM_DRAFT_VALUES_MAX_BYTES } from "./constants.js";
+import { FORM_DRAFT_KEY_MAX_LENGTH, FORM_DRAFT_VALUES_MAX_BYTES } from "./web/constants.js";
 const draftKeySchema = z.string().trim().min(1).max(FORM_DRAFT_KEY_MAX_LENGTH);
 // UTF-8 byte length, not string.length — `values` is arbitrary JSON that can
 // hold multi-byte characters, and the event-store row this ends up in is

package/dist/form-draft/{constants.js → web/constants.js}

@@ -1,4 +1,3 @@
-// @runtime client
 // form-draft bundle constants — feature-name + qualified handler/query names.
 //
 // Part of CosmicDriftGameStudio/kumiko-framework#1883 (wizard mode), issue #1889.

package/dist/form-draft-user-data/hooks.js

@@ -21,8 +21,8 @@ export const formDraftExportHook = async (ctx) => {
         })),
     };
 };
-// Real physical delete, not crypto-shredding — `draft` is jsonb (entity.ts
-// explains why it can't use the string-only PII field-encryption engine).
+// Deletes the row through the event store; `draft` is ciphertext under the
+// owner's key in the row and in every event (previous of the delete included).
 // A drafted form is pure pre-submit scratch state with no value once the
 // owner is gone, so both forget strategies (delete/anonymize) remove the
 // row outright rather than anonymizing in place. Per-row via the executor

package/dist/inbound-mail-foundation/handlers/list-accounts.query.d.ts

@@ -1,2 +1,2 @@
-import type { QueryHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
+import { type QueryHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 export declare const listAccountsQuery: QueryHandlerDef;

package/dist/inbound-mail-foundation/handlers/list-accounts.query.js

@@ -8,21 +8,29 @@
 // in-memory nach dem tenant-scoped select — Volumen ist die Anzahl
 // verbundener Postfächer eines Tenants (einstellig bis zweistellig).
 import { configuredPiiSubjectKms, decryptPiiFieldValues, } from "@cosmicdrift/kumiko-framework/crypto";
+import { MAX_LIST_LIMIT } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { MAIL_ACCOUNT_PII_FIELDS } from "../entities.js";
 import { mailAccountsProjectionTable } from "../projection.js";
 import { isVisibleToCaller } from "./scope-visibility.js";
-const listAccountsSchema = z.object({}).strict();
+// The projectionList screen always sends `limit`; unknown keys stay rejected.
+const listAccountsSchema = z
+    .object({ limit: z.number().int().min(1).max(MAX_LIST_LIMIT).default(MAX_LIST_LIMIT) })
+    .strict();
 export const listAccountsQuery = {
     name: "account:list",
     schema: listAccountsSchema,
     access: { roles: ["SystemAdmin", "TenantAdmin", "User"] },
     description: "Lists the connected mailboxes of the caller's tenant with the mailbox address decrypted, hiding personal mailboxes the caller neither owns nor administers; use it for the mail connect and settings views.",
-    handler: async (_query, ctx) => {
+    handler: async (query, ctx) => {
+        const { limit } = listAccountsSchema.parse(query.payload);
         const allRows = await ctx.db.selectMany(mailAccountsProjectionTable, {
             tenantId: ctx.user.tenantId,
         });
-        const rows = allRows.filter((row) => isVisibleToCaller(row, ctx.user));
+        const rows = allRows
+            .filter((row) => isVisibleToCaller(row, ctx.user))
+            .sort((a, b) => String(a["id"]).localeCompare(String(b["id"])))
+            .slice(0, limit);
         const piiKms = configuredPiiSubjectKms();
         if (!piiKms)
             return { rows };

package/dist/inbound-mail-foundation/retention-sweep.js

@@ -23,8 +23,8 @@
 // shreddet keinen Key. Echte Art.-17-Erasure der Event-Payloads passiert
 // erst bei tenant-destroy (Key-Erase). Read-Row + Body-File sind nach dem
 // Sweep weg; das Event-Log ist append-only by design.
-import { deleteMany, selectMany, } from "@cosmicdrift/kumiko-framework/db";
-import { archiveStream } from "@cosmicdrift/kumiko-framework/event-store";
+import { deleteMany, selectMany } from "@cosmicdrift/kumiko-framework/db";
+import { archiveStream, deleteRowsWithoutReplayableStream, } from "@cosmicdrift/kumiko-framework/event-store";
 import { seenMessageTable } from "./entities.js";
 import { INBOUND_MESSAGE_AGGREGATE_TYPE } from "./events.js";
 import { inboundMessagesProjectionTable } from "./projection.js";
@@ -86,10 +86,12 @@ async function purgeExpiredMessages(args, cutoff) {
             ids.push(row.id);
         }
         if (ids.length > 0) {
-            await deleteMany(args.db, inboundMessagesProjectionTable, {
-                id: { in: ids },
+            const deleted = await deleteRowsWithoutReplayableStream(args.db, {
+                table: inboundMessagesProjectionTable,
+                ids,
+                tenantId: args.tenantId,
             });
-            messagesPurged += ids.length;
+            messagesPurged += deleted.length;
         }
         if (rows.length < BATCH_LIMIT)
             break;

package/dist/jobs/feature.js

@@ -1,5 +1,4 @@
 import { defineFeature, i18nKey, } from "@cosmicdrift/kumiko-framework/engine";
-import { JOB_RUN_DETAIL_SCREEN_ID, JOB_RUNS_SCREEN_ID, JobHandlers, JobQueries, } from "./constants.js";
 import { catalogQuery } from "./handlers/catalog.query.js";
 import { detailQuery } from "./handlers/detail.query.js";
 import { listQuery } from "./handlers/list.query.js";
@@ -11,10 +10,11 @@ import { createStaleRunSweepJob, DEFAULT_JOB_RUN_STALE_TIMEOUT_HOURS, } from "./
 import { tenantFailuresQuery } from "./handlers/tenant-failures.query.js";
 import { tenantRunsQuery } from "./handlers/tenant-runs.query.js";
 import { triggerWrite } from "./handlers/trigger.write.js";
-import { JOBS_I18N } from "./i18n.js";
 import { jobRunLogsTableMeta, jobRunsTableMeta } from "./job-run-table.js";
 import { tenantJobFailuresTableMeta } from "./tenant-job-failure-table.js";
 import { tenantJobRunsTableMeta } from "./tenant-job-run-table.js";
+import { JOB_RUN_DETAIL_SCREEN_ID, JOB_RUNS_SCREEN_ID, JobHandlers, JobQueries, } from "./web/constants.js";
+import { JOBS_I18N } from "./web/i18n.js";
 export function createJobsFeature(options = {}) {
     const retentionDays = options.retentionDays ?? DEFAULT_JOB_RUN_RETENTION_DAYS;
     const staleRunTimeoutHours = options.staleRunTimeoutHours ?? DEFAULT_JOB_RUN_STALE_TIMEOUT_HOURS;

package/dist/jobs/handlers/retry.write.js

@@ -5,8 +5,8 @@ import { InternalError, NotFoundError, UnprocessableError, writeFailure, } from
 import { parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared/index.js";
-import { JobErrors } from "../constants.js";
 import { jobRunsTable } from "../job-run-table.js";
+import { JobErrors } from "../web/constants.js";
 export const retryWrite = defineWriteHandler({
     name: "retry",
     description: "Re-dispatches a failed job run with its original payload and triggering user; use it to rerun a job that failed for a transient reason.",

package/dist/jobs/handlers/trigger.write.js

@@ -1,8 +1,8 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, UnprocessableError, validationErrorFromZod, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { JobErrors } from "../constants.js";
 import { isManualTrigger } from "../is-manual-trigger.js";
+import { JobErrors } from "../web/constants.js";
 function invalidPayloadError() {
     return new UnprocessableError(JobErrors.invalidPayload, {
         i18nKey: "jobs.errors.invalidPayload",

package/dist/jobs/index.d.ts

@@ -1,4 +1,3 @@
-export { JOBS_FEATURE, JobErrors, JobHandlers, JobQueries } from "./constants.ts";
 export { createJobsFeature, type JobsFeatureOptions } from "./feature.ts";
 export type { JobRunLoggerCallbacks } from "./job-run-logger.ts";
 export { createJobRunLogger } from "./job-run-logger.ts";
@@ -7,3 +6,4 @@ export { jobRunLogsTable, jobRunsTable } from "./job-run-table.ts";
 export { tenantJobFailuresTable } from "./tenant-job-failure-table.ts";
 export type { TenantJobRunStatus } from "./tenant-job-run-table.ts";
 export { tenantJobRunsTable } from "./tenant-job-run-table.ts";
+export { JOBS_FEATURE, JobErrors, JobHandlers, JobQueries } from "./web/constants.ts";

package/dist/jobs/index.js

@@ -1,6 +1,6 @@
-export { JOBS_FEATURE, JobErrors, JobHandlers, JobQueries } from "./constants.js";
 export { createJobsFeature } from "./feature.js";
 export { createJobRunLogger } from "./job-run-logger.js";
 export { jobRunLogsTable, jobRunsTable } from "./job-run-table.js";
 export { tenantJobFailuresTable } from "./tenant-job-failure-table.js";
 export { tenantJobRunsTable } from "./tenant-job-run-table.js";
+export { JOBS_FEATURE, JobErrors, JobHandlers, JobQueries } from "./web/constants.js";

package/dist/jobs/web/client-plugin.js

@@ -1,7 +1,6 @@
-// @runtime client
 import { mergeTranslations } from "@cosmicdrift/kumiko-renderer";
-import { JOBS_FEATURE } from "../constants.js";
-import { defaultTranslations } from "./i18n.js";
+import { JOBS_FEATURE } from "./constants.js";
+import { defaultTranslations } from "./default-translations.js";
 export function jobsClient(options) {
     return {
         name: JOBS_FEATURE,

package/dist/jobs/{constants.js → web/constants.js}

@@ -1,4 +1,3 @@
-// @runtime client
 // Feature name + qualified names for server handlers and web screens.
 export const JOBS_FEATURE = "jobs";
 // Qualified write handler names (QN format: scope:type:name)

package/dist/jobs/web/default-translations.d.ts

@@ -0,0 +1,2 @@
+import { type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+export declare const defaultTranslations: TranslationsByLocale;

package/dist/jobs/web/default-translations.js

@@ -0,0 +1,3 @@
+import { translationsByLocaleFromKeys, } from "@cosmicdrift/kumiko-renderer";
+import { JOBS_I18N } from "./i18n.js";
+export const defaultTranslations = translationsByLocaleFromKeys(JOBS_I18N);

package/dist/jobs/web/i18n.d.ts

@@ -1,2 +1,5 @@
-import { type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
-export declare const defaultTranslations: TranslationsByLocale;
+type LocalizedString = {
+    readonly en: string;
+};
+export declare const JOBS_I18N: Readonly<Record<string, LocalizedString>>;
+export {};

package/dist/jobs/web/i18n.js

@@ -1,4 +1,51 @@
-// @runtime client
-import { translationsByLocaleFromKeys, } from "@cosmicdrift/kumiko-renderer";
-import { JOBS_I18N } from "../i18n.js";
-export const defaultTranslations = translationsByLocaleFromKeys(JOBS_I18N);
+// Server + client i18n for jobs operator screens.
+export const JOBS_I18N = {
+    "screen:job-runs.title": { en: "Job runs" },
+    "screen:job-run-detail.title": { en: "Job run" },
+    "screen:job-trigger.title": { en: "Trigger job" },
+    "jobs.screen.job-trigger.subtitle": {
+        en: "Start a job manually by name, with an optional JSON payload.",
+    },
+    "jobs.screen.job-run-detail.subtitle": {
+        en: "Status, timings, error and log lines of one job run.",
+    },
+    "jobs:entity:__action-form__:field:jobName": { en: "Job name" },
+    "jobs:entity:__action-form__:field:payload": { en: "JSON payload" },
+    "jobs:nav.jobRuns": { en: "Jobs" },
+    "jobs.runs.open": { en: "Details" },
+    "jobs.runs.filter.status": { en: "Status" },
+    "jobs.runs.filter.completed": { en: "Completed" },
+    "jobs.runs.filter.failed": { en: "Failed" },
+    "jobs.runs.filter.running": { en: "Running" },
+    "jobs.runs.filter.queued": { en: "Queued" },
+    "jobs.runs.col.job": { en: "Job" },
+    "jobs.runs.col.status": { en: "Status" },
+    "jobs.runs.col.started": { en: "Started" },
+    "jobs.runs.col.duration": { en: "Duration (ms)" },
+    "jobs.detail.field.job": { en: "Job" },
+    "jobs.detail.field.status": { en: "Status" },
+    "jobs.detail.field.id": { en: "Run ID" },
+    "jobs.detail.field.started": { en: "Started" },
+    "jobs.detail.field.finished": { en: "Finished" },
+    "jobs.detail.field.duration": { en: "Duration (ms)" },
+    "jobs.detail.field.error": { en: "Error" },
+    "jobs.detail.logs": { en: "Logs" },
+    "jobs.detail.retry": { en: "Retry" },
+    "jobs.trigger.title": { en: "Run a job" },
+    "jobs.errors.invalidCursor": { en: "The pagination cursor is invalid." },
+    "jobs.trigger.submit": { en: "Run" },
+    "jobs.errors.unknownJob": { en: "Unknown job." },
+    "jobs.errors.notManual": {
+        en: "This job cannot be triggered manually.",
+    },
+    "jobs.errors.invalidPayload": {
+        en: "The payload must be a valid JSON object.",
+    },
+    "jobs.errors.notFound": { en: "Not found." },
+    "jobs.errors.onlyFailedCanRetry": {
+        en: "Only failed runs can be retried.",
+    },
+    "jobs.errors.payloadErased": {
+        en: "This run's payload can no longer be read — the triggering user's data was erased.",
+    },
+};

package/dist/jobs/web/index.js

@@ -1,2 +1 @@
-// @runtime client
 export { jobsClient } from "./client-plugin.js";

package/dist/ledger/entity.d.ts

@@ -188,7 +188,7 @@ export declare const transactionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly minItems?: number;
         readonly maxItems?: number;
         readonly derived?: Readonly<Record<string, import("@cosmicdrift/kumiko-types/fields").EmbeddedDerivedCellDef>>;
-        readonly totals?: readonly string[];
+        readonly totals?: readonly import("@cosmicdrift/kumiko-types/fields").EmbeddedTotalDef[];
         readonly totalsMatch?: Readonly<Record<string, string>>;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         multiple: true;

package/dist/ledger/entity.js

@@ -1,6 +1,6 @@
 import { sql } from "@cosmicdrift/kumiko-framework/db";
 import { createDateField, createEmbeddedListField, createEntity, createNumberField, createSelectField, createTextField, } from "@cosmicdrift/kumiko-framework/engine";
-import { ACCOUNT_TYPES, SCHEDULE_INTERVALS, TRANSACTION_STATUS } from "./constants.js";
+import { ACCOUNT_TYPES, SCHEDULE_INTERVALS, TRANSACTION_STATUS } from "./web/constants.js";
 // account — a node in the chart of accounts. Event-sourced (create/update/list/
 // detail via the standard handlers); the framework projects `read_ledger_accounts`
 // from its CRUD events. `parentId` null → root account; otherwise the chart-of-

package/dist/ledger/feature.js

@@ -12,13 +12,13 @@
 //
 // Spec: kumiko-platform/docs/plans/ledger-feature.md
 import { defineEntityCreateHandler, defineEntityDetailHandler, defineEntityListHandler, defineEntityUpdateHandler, defineFeature, } from "@cosmicdrift/kumiko-framework/engine";
-import { DEFAULT_LEDGER_ACCESS, LEDGER_FEATURE_NAME } from "./constants.js";
 import { accountEntity, scheduleEntity, transactionEntity } from "./entity.js";
 import { createConfirmSchedulePeriodHandler } from "./handlers/confirm-schedule-period.write.js";
 import { createCreateTransactionHandler } from "./handlers/create-transaction.write.js";
 import { createBalanceSheetHandler, createBalancesReportHandler, createIncomeStatementHandler, } from "./handlers/reports.query.js";
 import { createReverseTransactionHandler } from "./handlers/reverse-transaction.write.js";
 import { requireScheduleSubjectPair } from "./schedule-subject-pair.js";
+import { DEFAULT_LEDGER_ACCESS, LEDGER_FEATURE_NAME } from "./web/constants.js";
 function registerLedger(r, access, toggleable) {
     r.describe("Double-entry bookkeeping primitive. Owns two event-sourced entities — the per-tenant `account` chart of accounts (`read_ledger_accounts`, self-referential via parentId, typed asset/liability/equity/income/expense) and immutable `transaction` journal entries (`read_ledger_transactions`) whose balanced posting lines are embedded as jsonb (Σ amount = 0, signed integer minor units). The account catalog uses the generic entity handlers (create, update, list, detail); create-transaction books a balanced entry (Σ=0 and ≥2 distinct accounts enforced at the command boundary, referential integrity against accounts checked) and reverse-transaction books its Storno mirror — there is deliberately NO transaction update/delete, so a posted entry is an immutable fact and the audit trail stays intact. Recurring schedules (`read_ledger_schedules`) layer Dauerauftrag templates on top — a schedule names debit/credit accounts, an amount, a monthly interval and an optional caller-assigned `sourceRef` key (filterable, to find a schedule again), from which the Soll (forecast) is a pure projection (projectSchedule) needing no bookings, and confirm-schedule-period materialises one period as an idempotent, reversal-aware balanced entry referencing scheduleReference(id, period); only confirming writes. Balances and reports (balance sheet, P&L, cashflow) derive as pure queries over the postings. Everything financial — banking, accounting, rent cashflow, credits, invoices — models as accounts + balanced transactions on top. Pin roles with createLedgerFeature({ roles }) or adopt the host model with { access }; pass { toggleable: { default: false } } to tier-gate the whole feature.");
     r.uiHints({

package/dist/ledger/handlers/confirm-schedule-period.write.js

@@ -1,15 +1,13 @@
-import { acquireNamespacedAdvisoryLock } from "@cosmicdrift/kumiko-framework/db";
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
-import { DEFAULT_LEDGER_ACCESS } from "../constants.js";
 import { accountExecutor, scheduleExecutor, transactionExecutor, transactionTable, } from "../executor.js";
 import { findReversedIds, isoMonth, scheduleReference } from "../recurring.js";
 import { confirmSchedulePeriodPayloadSchema, } from "../schemas.js";
 import { readSubjectReference } from "../subject-reference.js";
+import { DEFAULT_LEDGER_ACCESS } from "../web/constants.js";
 // pg_advisory_xact_lock namespace (int4): 'lcsp' as ASCII, disjoint from the
 // framework's other fixed advisory-lock keys.
 const CONFIRM_PERIOD_LOCK_NAMESPACE = 0x6c637370;
-const CONFIRM_PERIOD_LOCK_REASON = "takes the per-(tenant, reference) advisory lock so parallel confirms cannot both pass the already-booked check; TenantDb has no lock API";
 // confirm-schedule-period — turn ONE projected period of a schedule into a posted,
 // balanced transaction (debit +amount / credit −amount), tagged with
 // scheduleReference(scheduleId, period) so the host can merge Soll vs. Ist.
@@ -24,7 +22,6 @@ export function createConfirmSchedulePeriodHandler(access = DEFAULT_LEDGER_ACCES
         name: "confirm-schedule-period",
         schema: confirmSchedulePeriodPayloadSchema,
         access,
-        escapeHatch: { grants: ["unsafeRaw"], reason: CONFIRM_PERIOD_LOCK_REASON },
         description: "Turns one month of a recurring schedule into a posted balanced entry between its debit and credit account, returning the existing booking instead when that period is already booked and not reversed; use it to move a forecast period into the actual books.",
         handler: async (event, ctx) => {
             const payload = event.payload; // @cast-boundary engine-payload
@@ -50,7 +47,7 @@ export function createConfirmSchedulePeriodHandler(access = DEFAULT_LEDGER_ACCES
             // tx's `reference` names its id).
             // No unique index on (tenantId, reference): a Storno makes re-confirming the
             // same reference legitimate, so the check-then-write is serialized by a lock.
-            await acquireNamespacedAdvisoryLock(ctx.db.unsafeRaw(), CONFIRM_PERIOD_LOCK_NAMESPACE, `${event.user.tenantId}:${reference}`);
+            await ctx.db.advisoryXactLock(CONFIRM_PERIOD_LOCK_NAMESPACE, reference);
             const candidates = await ctx.db.selectMany(transactionTable, {
                 tenantId: event.user.tenantId,
                 reference,

package/dist/ledger/handlers/create-transaction.write.js

@@ -1,8 +1,8 @@
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
-import { DEFAULT_LEDGER_ACCESS } from "../constants.js";
 import { accountExecutor, transactionExecutor } from "../executor.js";
 import { createTransactionPayloadSchema } from "../schemas.js";
+import { DEFAULT_LEDGER_ACCESS } from "../web/constants.js";
 // create-transaction — books a balanced journal entry. The Σ=0 and ≥2-accounts
 // invariants are enforced by createTransactionPayloadSchema (command boundary).
 // This handler adds referential integrity (every posting's account must exist —

package/dist/ledger/handlers/reports.query.js

@@ -1,7 +1,7 @@
 import * as z from "zod";
-import { DEFAULT_LEDGER_ACCESS } from "../constants.js";
 import { accountTable, transactionTable } from "../executor.js";
 import { accountBalances, balanceSheet, incomeStatement, toAccounts, toEntries, } from "../reports.js";
+import { DEFAULT_LEDGER_ACCESS } from "../web/constants.js";
 // Reports take an optional reporting period. Balance-sheet is cumulative → pass
 // { to: asOf }; income-statement is a period → { from, to }.
 const periodSchema = z.object({

package/dist/ledger/handlers/reverse-transaction.write.js

@@ -1,10 +1,10 @@
 import { ConflictError, NotFoundError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
-import { DEFAULT_LEDGER_ACCESS } from "../constants.js";
 import { transactionExecutor, transactionTable } from "../executor.js";
 import { normalizeLines } from "../reports.js";
 import { reverseTransactionPayloadSchema } from "../schemas.js";
 import { readSubjectReference } from "../subject-reference.js";
+import { DEFAULT_LEDGER_ACCESS } from "../web/constants.js";
 // reverse-transaction (Storno) — the ONLY correction path for a posted entry.
 // Books the mirror image (every amount negated) as a new posted entry that
 // references the original, leaving the original untouched. This is why

package/dist/ledger/index.d.ts

@@ -1,4 +1,3 @@
-export { ACCOUNT_TYPES, type AccountType, DEFAULT_LEDGER_ACCESS, DEFAULT_LEDGER_ROLES, LEDGER_FEATURE_NAME, LedgerHandlers, LedgerQueries, SCHEDULE_INTERVALS, type ScheduleInterval, TRANSACTION_STATUS, type TransactionStatus, } from "./constants.ts";
 export { accountEntity, scheduleEntity, transactionEntity } from "./entity.ts";
 export { createLedgerFeature, type LedgerFeatureOptions, } from "./feature.ts";
 export { confirmSchedulePeriodHandler, createConfirmSchedulePeriodHandler, } from "./handlers/confirm-schedule-period.write.ts";
@@ -8,3 +7,4 @@ export { createReverseTransactionHandler, reverseTransactionHandler, } from "./h
 export { findReversedIds, type LedgerTxRow, mergeScheduleActuals, type ProjectedPeriod, projectSchedule, type ScheduleDef, type ScheduleMonth, type ScheduleMonthStatus, scheduleReference, } from "./recurring.ts";
 export { type AccountBalance, accountBalances, type BalanceSheet, type BalancesReport, balanceSheet, type IncomeStatement, incomeStatement, type LedgerAccount, type LedgerEntry, type Period, rawBalances, } from "./reports.ts";
 export { accountTypeSchema, type ConfirmSchedulePeriodPayload, type CreateTransactionPayload, confirmSchedulePeriodPayloadSchema, createTransactionPayloadSchema, type Posting, postingSchema, type ReverseTransactionPayload, reverseTransactionPayloadSchema, } from "./schemas.ts";
+export { ACCOUNT_TYPES, type AccountType, DEFAULT_LEDGER_ACCESS, DEFAULT_LEDGER_ROLES, LEDGER_FEATURE_NAME, LedgerHandlers, LedgerQueries, SCHEDULE_INTERVALS, type ScheduleInterval, TRANSACTION_STATUS, type TransactionStatus, } from "./web/constants.ts";

package/dist/ledger/index.js

@@ -1,4 +1,3 @@
-export { ACCOUNT_TYPES, DEFAULT_LEDGER_ACCESS, DEFAULT_LEDGER_ROLES, LEDGER_FEATURE_NAME, LedgerHandlers, LedgerQueries, SCHEDULE_INTERVALS, TRANSACTION_STATUS, } from "./constants.js";
 export { accountEntity, scheduleEntity, transactionEntity } from "./entity.js";
 export { createLedgerFeature, } from "./feature.js";
 export { confirmSchedulePeriodHandler, createConfirmSchedulePeriodHandler, } from "./handlers/confirm-schedule-period.write.js";
@@ -8,3 +7,4 @@ export { createReverseTransactionHandler, reverseTransactionHandler, } from "./h
 export { findReversedIds, mergeScheduleActuals, projectSchedule, scheduleReference, } from "./recurring.js";
 export { accountBalances, balanceSheet, incomeStatement, rawBalances, } from "./reports.js";
 export { accountTypeSchema, confirmSchedulePeriodPayloadSchema, createTransactionPayloadSchema, postingSchema, reverseTransactionPayloadSchema, } from "./schemas.js";
+export { ACCOUNT_TYPES, DEFAULT_LEDGER_ACCESS, DEFAULT_LEDGER_ROLES, LEDGER_FEATURE_NAME, LedgerHandlers, LedgerQueries, SCHEDULE_INTERVALS, TRANSACTION_STATUS, } from "./web/constants.js";

package/dist/ledger/recurring.d.ts

@@ -1,5 +1,5 @@
-import type { ScheduleInterval } from "./constants.ts";
 import type { Posting } from "./schemas.ts";
+import type { ScheduleInterval } from "./web/constants.ts";
 export type ScheduleDef = {
     readonly startDate: string;
     readonly endDate?: string | null;