@cosmicdrift/kumiko-bundled-features 0.385.0 → 0.387.0

package/dist/inbound-provider-imap/feature.js

@@ -1,27 +1,27 @@
 // kumiko-feature-version: 1
 //
-// inbound-provider-imap — IMAP-Implementierung der inbound-mail-
-// foundation Plugin-API. Deckt den DACH-Long-Tail (IONOS, Telekom,
-// Strato, GMX/Web.de, mailbox.org, Hetzner, all-inkl) via Passwort/
-// App-Passwort ab — komplett OHNE OAuth. XOAUTH2 als Fallback für
-// M365-/Gmail-Konten (Access-Token aus dem Secret-Slot; Token-Refresh
-// gehört den OAuth-Providern, Phase 4/5).
+// inbound-provider-imap — IMAP implementation of the inbound-mail-
+// foundation plugin API. Covers the DACH long tail (IONOS, Telekom,
+// Strato, GMX/Web.de, mailbox.org, Hetzner, all-inkl) via password/
+// app-password authentication, without OAuth. XOAUTH2 is available as
+// a fallback for M365/Gmail accounts (access token from the secret slot;
+// token refresh is handled by the OAuth providers).
 //
-// **Was diese Feature liefert:**
-//   1. Plugin-Registration via r.useExtension("inboundMailProvider",
+// **What this feature provides:**
+//   1. Plugin registration via r.useExtension("inboundMailProvider",
 //      "imap", { verify, fetch, watch }).
-//   2. verify: connect+logout mit typisiertem Fehler-Mapping.
-//   3. fetch: inkrementeller Sync über UIDVALIDITY:lastUid-Cursor —
-//      UIDVALIDITY-Wechsel wirft InboundCursorInvalidError (Foundation
-//      resettet + resynct im Backfill-Fenster). Erst-Befüllung via
-//      SEARCH since=backfillWindowDays.
-//   4. watch: IMAP IDLE via imapflow — 'exists'-Event → neue UIDs
-//      fetchen → onMessages; Verbindungs-Tod → onError (Supervisor
-//      restartet mit Backoff, der Provider reconnected NICHT selbst).
+//   2. verify: connect+logout with typed error mapping.
+//   3. fetch: incremental sync using a UIDVALIDITY:lastUid cursor —
+//      a UIDVALIDITY change throws InboundCursorInvalidError (the
+//      foundation resets and resyncs within the backfill window). Initial
+//      population uses SEARCH since=backfillWindowDays.
+//   4. watch: IMAP IDLE via imapflow — the 'exists' event triggers fetching
+//      new UIDs and then onMessages; connection loss triggers onError (the
+//      supervisor restarts with backoff; the provider does not reconnect).
 //
-// Credentials: JSON-Dokument im per-Account-Secret-Slot
-// (credential-document.ts) — kein Tenant-Config, weil mehrere Accounts
-// pro Tenant verschiedene Hosts haben.
+// Credentials: JSON document in the per-account secret slot
+// (credential-document.ts), not tenant configuration, because one tenant
+// can have multiple accounts with different hosts.
 import { mailAllowedPrivateHostsEnvSchema } from "@cosmicdrift/kumiko-bundled-features/foundation-shared";
 import { INBOUND_MAIL_PROVIDER_EXTENSION, InboundAuthError, inboundCredentialSecretKey, } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
 import { requireSecretsContext } from "@cosmicdrift/kumiko-bundled-features/secrets";
@@ -63,18 +63,18 @@ async function fetchMessages(ctx, account, cursor, opts) {
         const serverUidValidity = String(mailbox.uidValidity);
         const parsedCursor = parseImapCursor(cursor);
         assertUidValidity(parsedCursor, serverUidValidity);
-        // UID-Menge bestimmen: inkrementell ab lastUid+1, sonst Backfill
-        // über SEARCH since (Fenster begrenzt die Erst-Befüllung).
+        // Determine the UID set: incrementally from lastUid+1, or use a backfill
+        // via SEARCH since (the window limits the initial population).
         let uids;
         if (parsedCursor) {
             const found = await client.search({ uid: `${parsedCursor.lastUid + 1}:*` }, { uid: true });
-            // `N:*`-Gotcha: liegt N über der höchsten UID, liefert IMAP
-            // trotzdem die letzte Message — rausfiltern.
+            // `N:*` gotcha: when N exceeds the highest UID, IMAP still returns the
+            // last message, so filter it out.
             uids = (found || []).filter((uid) => uid > parsedCursor.lastUid);
         }
         else {
             const since = Temporal.Now.instant().subtract({ hours: opts.backfillWindowDays * 24 });
-            // imapflow-API-Boundary: search() verlangt ein JS-Date.
+            // imapflow API boundary: search() requires a JS Date.
             uids = (await client.search({ since: instantToLegacyDate(since) }, { uid: true })) || [];
         }
         uids.sort((a, b) => a - b);
@@ -111,8 +111,8 @@ async function fetchMessages(ctx, account, cursor, opts) {
     }
 }
 // =============================================================================
-// watch — IMAP IDLE (imapflow idlet automatisch bei offener Mailbox und
-// emittet 'exists' bei neuen Messages).
+// watch — IMAP IDLE (imapflow idles automatically while the mailbox is open
+// and emits 'exists' for new messages).
 // =============================================================================
 async function watchMailbox(ctx, account, handlers) {
     const doc = await readCredentialDocument(ctx, account);
@@ -122,13 +122,14 @@ async function watchMailbox(ctx, account, handlers) {
         await client.connect();
         const mailbox = (await client.mailboxOpen(IMAP_MAILBOX));
         const uidValidity = String(mailbox.uidValidity);
-        // uidNext = nächste zu vergebende UID — alles ab hier ist "neu".
+        // uidNext is the next UID to be assigned, so everything from here is
+        // "new".
         let nextUid = Number(mailbox.uidNext ?? 1);
         const drainNew = async () => {
             const messages = [];
             let maxSeen = nextUid - 1;
             for await (const msg of client.fetch(`${nextUid}:*`, { uid: true, internalDate: true, source: true }, { uid: true })) {
-                // `N:*`-Gotcha (siehe fetch): alte letzte Message rausfiltern.
+                // `N:*` gotcha (see fetch): filter out the previous last message.
                 if (msg.uid < nextUid || !msg.source)
                     continue;
                 messages.push(await toRawInboundMessage({
@@ -145,7 +146,7 @@ async function watchMailbox(ctx, account, handlers) {
                 await handlers.onMessages(messages);
         };
         client.on("exists", () => {
-            // skip: Watcher gestoppt — exists-Nachzügler ignorieren.
+            // skip: ignore delayed exists events after the watcher has stopped.
             if (stopped)
                 return;
             void drainNew().catch((err) => {
@@ -154,7 +155,7 @@ async function watchMailbox(ctx, account, handlers) {
             });
         });
         const die = (err) => {
-            // skip: bereits gestoppt/gestorben — onError nur einmal feuern.
+            // skip: already stopped or terminated; fire onError only once.
             if (stopped)
                 return;
             stopped = true;
@@ -162,10 +163,10 @@ async function watchMailbox(ctx, account, handlers) {
         };
         client.on("error", die);
         client.on("close", () => die(new Error("connection closed")));
-        // IDLE-Loop: 'exists' feuert NUR während client.idle() läuft
-        // (empirisch gegen greenmail verifiziert). Jedes zwischengeschobene
-        // Kommando (drainNew-fetch) beendet idle() — die Loop re-idlet,
-        // bis stop() die Verbindung schließt.
+        // IDLE loop: 'exists' fires ONLY while client.idle() is running
+        // (verified empirically against greenmail). Each intervening command
+        // (drainNew-fetch) ends idle(), so the loop re-enters idle() until
+        // stop() closes the connection.
         void (async () => {
             while (!stopped) {
                 try {
@@ -174,7 +175,8 @@ async function watchMailbox(ctx, account, handlers) {
                 catch (err) {
                     if (!stopped)
                         die(err);
-                    // skip: idle-Loop endet — die() hat den Supervisor informiert (bzw. stop() war die Ursache).
+                    // skip: the idle loop ends; die() has informed the supervisor (or stop()
+                    // was the cause).
                     return;
                 }
             }
@@ -195,8 +197,8 @@ async function watchMailbox(ctx, account, handlers) {
 // =============================================================================
 // Plugin + Feature-definition
 // =============================================================================
-/** Exportiert für den Live-Test (imap-live.integration.test.ts) —
- *  Apps nutzen das Feature, nie das Plugin direkt. */
+/** Exported for the live test (imap-live.integration.test.ts) —
+ *  applications use the feature, never the plugin directly. */
 export const imapInboundMailPlugin = {
     verify: async (ctx, account) => {
         const doc = await readCredentialDocument(ctx, account);
@@ -213,9 +215,9 @@ export const imapInboundMailPlugin = {
     },
     fetch: fetchMessages,
     watch: watchMailbox,
-    // Kein oauth-Block: Passwort-Connect läuft über das Credential-
-    // Formular (connect-account + Secret-Write); XOAUTH2-Token-Flows
-    // gehören den OAuth-Providern (M365/Gmail).
+    // No oauth block: password authentication runs through the credential
+    // form (connect-account + Secret-Write); XOAUTH2 token flows belong to
+    // the OAuth providers (M365/Gmail).
 };
 export function createInboundProviderImapFeature() {
     return defineFeature(FEATURE_NAME, (r) => {

package/dist/inbound-provider-imap/imap-client.d.ts

@@ -13,23 +13,24 @@ export type ImapCursor = {
     readonly lastUid: number;
 };
 export declare function parseImapCursor(cursor: SyncCursorPayload | null): ImapCursor | null;
-/** Wirft InboundCursorInvalidError bei UIDVALIDITY-Wechsel — die
- *  Foundation resettet den Cursor und macht einen Voll-Resync im
- *  Backfill-Fenster (Dedup fängt Dubletten). */
+/** Throws InboundCursorInvalidError when UIDVALIDITY changes; the
+ *  foundation resets the cursor and performs a full resync within the
+ *  backfill window (deduplication catches duplicates). */
 export declare function assertUidValidity(cursor: ImapCursor | null, serverUidValidity: string): void;
-/** References-Chain normalisieren: mailparser liefert string | string[]
- *  | undefined; fehlt References, trägt In-Reply-To den Thread-Anker. */
+/** Normalizes the References chain: mailparser returns string | string[]
+ *  | undefined; when References is missing, In-Reply-To provides the thread
+ *  anchor. */
 export declare function normalizeReferences(parsed: {
     references?: string | string[];
     inReplyTo?: string;
 }): string[];
-/** imapflow liefert internalDate je nach Codepfad als Date ODER string.
- *  String-Form verwerfen wir bewusst (kein Date-Parsing im Feature-Code,
- *  no-date-api) — toRawInboundMessage fällt dann auf mailparsers
- *  Date-Header zurück, der immer als echtes Date kommt. */
+/** imapflow provides internalDate as either a Date or string depending on
+ *  the code path. The string form is deliberately discarded (no date parsing
+ *  in feature code, no-date-api); toRawInboundMessage then falls back to the
+ *  mailparser Date header, which is always a real Date. */
 export declare function coerceDate(d: Date | string | undefined): Date | undefined;
-/** providerMessageId: UID ist nur innerhalb einer UIDVALIDITY eindeutig
- *  — beides zusammen ist der stabile Idempotency-Anchor. */
+/** providerMessageId: a UID is unique only within a UIDVALIDITY; together,
+ *  they form the stable idempotency anchor. */
 export declare function buildProviderMessageId(uidValidity: string, uid: number): string;
 export declare function toRawInboundMessage(args: {
     readonly source: Uint8Array;

package/dist/inbound-provider-imap/imap-client.js

@@ -1,6 +1,6 @@
-// imapflow-Wiring + pure Helpers des IMAP-Providers.
-// Referenz-Impl: /Users/marc/code/doc-o-mat (HEINZ) — aber inkrementeller
-// UIDVALIDITY:lastUid-Cursor statt '1:*'-Vollscan.
+// imapflow wiring and pure helpers for IMAP providers.
+// Reference implementation: /Users/marc/code/doc-o-mat (HEINZ), but uses an
+// incremental UIDVALIDITY:lastUid cursor instead of a '1:*' full scan.
 import { BlockedHostError, readAllowedPrivateMailHostsFromEnv, resolveMailConnectTarget, } from "@cosmicdrift/kumiko-bundled-features/foundation-shared";
 import { InboundAuthError, InboundCursorInvalidError, InboundTransientError, } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
@@ -71,9 +71,9 @@ export async function createImapClient(doc, hostGuard = {}) {
 }
 /** Server-Fehler → typisierte Foundation-Fehlerklassen (Plan §2). */
 export function mapImapError(err, host) {
-    // imapflow-Fehler tragen die Server-Antwort in responseText, die
-    // message ist nur "Command failed" — beides in den Match einbeziehen;
-    // authenticationFailed ist das verlässliche Flag.
+    // imapflow errors carry the server response in responseText; the
+    // message is only "Command failed", so both are included in the match;
+    // authenticationFailed is the reliable flag.
     const carrier = isPlainObject(err) ? err : undefined;
     const responseText = typeof carrier?.["responseText"] === "string" ? carrier["responseText"] : "";
     const msg = `${err instanceof Error ? err.message : String(err)} ${responseText}`.trim();
@@ -95,9 +95,9 @@ export function parseImapCursor(cursor) {
         return null;
     return { uidValidity, lastUid };
 }
-/** Wirft InboundCursorInvalidError bei UIDVALIDITY-Wechsel — die
- *  Foundation resettet den Cursor und macht einen Voll-Resync im
- *  Backfill-Fenster (Dedup fängt Dubletten). */
+/** Throws InboundCursorInvalidError when UIDVALIDITY changes; the
+ *  foundation resets the cursor and performs a full resync within the
+ *  backfill window (deduplication catches duplicates). */
 export function assertUidValidity(cursor, serverUidValidity) {
     if (cursor && cursor.uidValidity !== serverUidValidity) {
         throw new InboundCursorInvalidError(`UIDVALIDITY changed (${cursor.uidValidity} → ${serverUidValidity}) — full resync required`);
@@ -109,8 +109,9 @@ export function assertUidValidity(cursor, serverUidValidity) {
 function stripAngles(id) {
     return id.replace(/^<|>$/g, "").trim();
 }
-/** References-Chain normalisieren: mailparser liefert string | string[]
- *  | undefined; fehlt References, trägt In-Reply-To den Thread-Anker. */
+/** Normalizes the References chain: mailparser returns string | string[]
+ *  | undefined; when References is missing, In-Reply-To provides the thread
+ *  anchor. */
 export function normalizeReferences(parsed) {
     const raw = parsed.references;
     const list = raw === undefined ? [] : Array.isArray(raw) ? raw : raw.split(/\s+/);
@@ -128,15 +129,15 @@ function addressList(a) {
     const arr = Array.isArray(a) ? a : [a];
     return arr.map((x) => x.text).filter((t) => Boolean(t));
 }
-/** imapflow liefert internalDate je nach Codepfad als Date ODER string.
- *  String-Form verwerfen wir bewusst (kein Date-Parsing im Feature-Code,
- *  no-date-api) — toRawInboundMessage fällt dann auf mailparsers
- *  Date-Header zurück, der immer als echtes Date kommt. */
+/** imapflow provides internalDate as either a Date or string depending on
+ *  the code path. The string form is deliberately discarded (no date parsing
+ *  in feature code, no-date-api); toRawInboundMessage then falls back to the
+ *  mailparser Date header, which is always a real Date. */
 export function coerceDate(d) {
     return d instanceof Date ? d : undefined;
 }
-/** providerMessageId: UID ist nur innerhalb einer UIDVALIDITY eindeutig
- *  — beides zusammen ist der stabile Idempotency-Anchor. */
+/** providerMessageId: a UID is unique only within a UIDVALIDITY; together,
+ *  they form the stable idempotency anchor. */
 export function buildProviderMessageId(uidValidity, uid) {
     return `${uidValidity}:${uid}`;
 }
@@ -155,8 +156,8 @@ export async function toRawInboundMessage(args) {
         cc: addressList(parsed.cc),
         subject: parsed.subject ?? "",
         snippet: text.slice(0, SNIPPET_MAX),
-        // Lib-Boundary-Bridge (Date von imapflow/mailparser) → Temporal;
-        // fehlt jedes Datum, ist Epoch der ehrliche Marker.
+        // Lib-boundary bridge (Date from imapflow/mailparser) → Temporal;
+        // when no date exists, Epoch is the honest marker.
         receivedAtIso: (receivedAt
             ? legacyDateToInstant(receivedAt)
             : Temporal.Instant.fromEpochMilliseconds(0)).toString(),

package/dist/inbound-provider-inmemory/feature.d.ts

@@ -1,18 +1,18 @@
 import type { InboundMailProviderPlugin, RawInboundMessage } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
 export declare const INMEMORY_PROVIDER_KEY = "inmemory";
-/** Test-Helper: Message ins Postfach legen. Läuft ein watch, wird sie
- *  sofort gepusht (IDLE-Simulation); der nächste fetch liefert sie
- *  cursor-basiert ebenfalls — Dedup der Foundation macht das idempotent. */
+/** Test helper: adds a message to the mailbox. If a watch is active, it is
+ *  pushed immediately (IDLE simulation); the next fetch also returns it by
+ *  cursor — the foundation's deduplication makes this idempotent. */
 export declare function seedInboundMessage(accountId: string, msg: RawInboundMessage): Promise<void>;
-/** Test-Helper: One-Shot-Fehler für den nächsten fetch (z.B.
- *  InboundAuthError, InboundCursorInvalidError). */
+/** Test helper: injects a one-shot error into the next fetch (e.g.
+ *  InboundAuthError or InboundCursorInvalidError). */
 export declare function failNextFetchWith(accountId: string, err: unknown): void;
-/** Test-Helper: One-Shot-Fehler für das nächste verify. */
+/** Test helper: injects a one-shot error into the next verify. */
 export declare function failNextVerifyWith(accountId: string, err: unknown): void;
-/** Test-Helper: Tod der Live-Verbindung simulieren (Supervisor muss
- *  mit Backoff neu starten). */
+/** Test helper: simulates the live connection terminating (the supervisor
+ *  must restart with backoff). */
 export declare function emitWatchError(accountId: string, err: unknown): void;
-/** Test-Helper: läuft gerade ein watch für den Account? */
+/** Test helper: reports whether an account currently has an active watch. */
 export declare function isWatching(accountId: string): boolean;
 /** Test-Helper: kompletter State-Reset (Test-Isolation — Mock-States
  *  nie zwischen Tests teilen). */

package/dist/inbound-provider-inmemory/feature.js

@@ -1,15 +1,15 @@
 // kumiko-feature-version: 1
 //
-// inbound-provider-inmemory — scriptbarer In-Memory-Provider für die
-// inbound-mail-foundation Plugin-API. Für Tests, Demos und Sample-Apps:
-// Messages werden per `seedInboundMessage()` eingespeist statt von einem
-// echten Postfach gefetcht; `watch()` pusht geseedete Messages sofort
-// (IDLE-Simulation), `fetch()` liefert sie cursor-basiert nach
-// (Reconciliation-Pfad) — beide Pfade zusammen exercisen exakt die
-// Dedup-Garantie der Foundation.
+// inbound-provider-inmemory — scriptable in-memory provider for the
+// inbound-mail-foundation plugin API. For tests, demos, and sample apps:
+// messages are supplied via `seedInboundMessage()` instead of being fetched
+// from a real mailbox; `watch()` immediately pushes seeded messages
+// (IDLE simulation), while `fetch()` returns them by cursor
+// (reconciliation path). Together, both paths exercise the foundation's
+// deduplication guarantee exactly.
 //
-// **Pattern-Vorbild:** mail-transport-inmemory (module-level State +
-// Test-Helper-Exports). NICHT für Production.
+// **Pattern basis:** mail-transport-inmemory (module-level state +
+// test-helper exports). Not for production.
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 const FEATURE_NAME = "inbound-provider-inmemory";
 export const INMEMORY_PROVIDER_KEY = "inmemory";
@@ -22,26 +22,26 @@ function stateFor(accountId) {
     }
     return state;
 }
-/** Test-Helper: Message ins Postfach legen. Läuft ein watch, wird sie
- *  sofort gepusht (IDLE-Simulation); der nächste fetch liefert sie
- *  cursor-basiert ebenfalls — Dedup der Foundation macht das idempotent. */
+/** Test helper: adds a message to the mailbox. If a watch is active, it is
+ *  pushed immediately (IDLE simulation); the next fetch also returns it by
+ *  cursor — the foundation's deduplication makes this idempotent. */
 export async function seedInboundMessage(accountId, msg) {
     const state = stateFor(accountId);
     state.log.push(msg);
     if (state.watch)
         await state.watch.onMessages([msg]);
 }
-/** Test-Helper: One-Shot-Fehler für den nächsten fetch (z.B.
- *  InboundAuthError, InboundCursorInvalidError). */
+/** Test helper: injects a one-shot error into the next fetch (e.g.
+ *  InboundAuthError or InboundCursorInvalidError). */
 export function failNextFetchWith(accountId, err) {
     stateFor(accountId).nextFetchError = err;
 }
-/** Test-Helper: One-Shot-Fehler für das nächste verify. */
+/** Test helper: injects a one-shot error into the next verify. */
 export function failNextVerifyWith(accountId, err) {
     stateFor(accountId).nextVerifyError = err;
 }
-/** Test-Helper: Tod der Live-Verbindung simulieren (Supervisor muss
- *  mit Backoff neu starten). */
+/** Test helper: simulates the live connection terminating (the supervisor
+ *  must restart with backoff). */
 export function emitWatchError(accountId, err) {
     const state = accounts.get(accountId);
     if (state?.watch) {
@@ -50,7 +50,7 @@ export function emitWatchError(accountId, err) {
         handlers.onError(err);
     }
 }
-/** Test-Helper: läuft gerade ein watch für den Account? */
+/** Test helper: reports whether an account currently has an active watch. */
 export function isWatching(accountId) {
     return accounts.get(accountId)?.watch != null;
 }
@@ -60,7 +60,7 @@ export function resetInboundInMemory() {
     accounts.clear();
 }
 // =============================================================================
-// Plugin — cursor = { offset: number } über das append-only-Log.
+// Plugin — cursor = { offset: number } over the append-only log.
 // =============================================================================
 function offsetOf(cursor) {
     const raw = cursor?.["offset"];

package/dist/jobs/db/queries/retention.js

@@ -1,4 +1,4 @@
-// Job-run retention (#2243): store_job_runs/store_job_run_logs are
+// Job-run retention: store_job_runs/store_job_run_logs are
 // direct-write stores now, not event-sourced projections — nothing else
 // purges them, so without this query they grow forever with the run count
 // instead of the runtime. Not the retention-cleanup executor: that executor
@@ -18,7 +18,7 @@ export async function deleteStaleJobRuns(db, retentionDays) {
     const cutoff = Temporal.Now.instant().subtract({ hours: retentionDays * 24 });
     const logsResult = await deleteManyBatched(db, jobRunLogsTable, { timestamp: { lt: cutoff } }, { limit: RETENTION_DELETE_BATCH_SIZE });
     const runsResult = await deleteManyBatched(db, jobRunsTable, { insertedAt: { lt: cutoff } }, { limit: RETENTION_DELETE_BATCH_SIZE });
-    // Same window for the tenant-visible failure records (fw#3079): the run
+    // Same window for the tenant-visible failure records: the run
     // they point at is gone by now, and a job whose subject never ran again
     // would otherwise keep its record forever.
     const tenantFailuresResult = await deleteManyBatched(db, tenantJobFailuresTable, { failedAt: { lt: cutoff } }, { limit: RETENTION_DELETE_BATCH_SIZE });

package/dist/jobs/db/queries/stale-run-sweep.js

@@ -1,5 +1,5 @@
-// Stale job-run sweep (#2246): store_job_runs is a direct-write store
-// (#2243) — status is set to "running" once at onJobStart and only ever
+// Stale job-run sweep: store_job_runs is a direct-write store
+// Status is set to "running" once at onJobStart and only ever
 // flipped to "completed"/"failed" by onJobComplete/onJobFailed. If the
 // process dies mid-run (crash, OOM, kill -9), those callbacks never fire and
 // the row is stuck on "running" forever — nothing else on the read side
@@ -31,7 +31,7 @@ export async function markStaleJobRunsFailed(db, timeoutHours, queuedRetentionDa
     // user subject annotation as job-run-logger.ts's onJobFailed path
     // (personal: { of: "triggeredById" } on job-run-table.ts), so it is encrypted
     // under the triggering user's DEK, or the system tenant key when
-    // triggeredById is null (whenAbsent: "tenant", fw#3654). Runs are grouped by
+    // triggeredById is null (whenAbsent: "tenant"). Runs are grouped by
     // that subject: one encrypt and one updateMany per subject instead of per run.
     const stale = await selectMany(db, jobRunsTable, {
         status: "running",

package/dist/jobs/events.js

@@ -1,4 +1,4 @@
-// Payload schemas for the jobRun direct-write path (#2243). Pre-#2243 these
+// Payload schemas for the jobRun direct-write path. Previously these
 // backed jobRun's event-store payloads (r.defineEvent + inline projections);
 // now job-run-logger.ts parses against them before writing straight into
 // jobRunsTable/jobRunLogsTable, so an out-of-dispatcher write still gets the

package/dist/jobs/feature.js

@@ -31,11 +31,10 @@ export function createJobsFeature(options = {}) {
         r.storeTable(jobRunsTableMeta, {
             reason: "direct_write.job_runs",
             // payload/error carry personal:{of:"triggeredById"} (job-run-table.ts): encrypted under the
-            // triggering user's DEK, or the system tenant key when triggeredById is null
-            // (whenAbsent: "tenant", fw#3654).
+            // triggering user's DEK, or the system tenant key when triggeredById is null.
             // job-run-logger.ts manually encrypts both before every insert/update
             // (encryptStartedPayload/encryptFailureError) since this store bypasses
-            // the executor's automatic PII pipeline (#2243).
+            // the executor's automatic PII pipeline.
             piiEncryptedOnWrite: true,
         });
         r.storeTable(jobRunLogsTableMeta, {
@@ -49,7 +48,7 @@ export function createJobsFeature(options = {}) {
         });
         // Framework-provided rebuild job — available whenever `jobs` is composed; enqueueProjectionRebuild dispatches it.
         r.job("projectionRebuild", { trigger: { manual: true }, concurrency: "skip", schema: projectionRebuildPayloadSchema }, projectionRebuildJob);
-        // Retroactive search backfill (#1206/#1215) — manual + perTenant, so one
+        // Retroactive search backfill — manual + perTenant, so one
         // `jobs:write:trigger` call with { entity } fans out to every active
         // tenant (job-runner.ts perTenant dispatch applies to manual triggers
         // too, not just cron).
@@ -60,10 +59,10 @@ export function createJobsFeature(options = {}) {
             schema: reindexEntityPayloadSchema,
         }, reindexEntityJob);
         // store_job_runs/store_job_run_logs are direct-write, unbounded-growth
-        // stores (#2243) — nothing else purges them.
+        // stores — nothing else purges them.
         r.job("retention-cleanup", { trigger: { cron: "0 3 * * *" }, concurrency: "skip" }, createRetentionCleanupJob(retentionDays));
         // Sweeps store_job_runs for rows stuck at status "running" past the
-        // timeout (#2246). Hourly matches the timeout's own granularity —
+        // timeout. Hourly matches the timeout's own granularity —
         // frequent enough to catch a stuck run soon after it crosses the
         // threshold, cheap enough that an (almost always empty) result set
         // doesn't matter.

package/dist/jobs/handlers/detail.query.js

@@ -27,11 +27,11 @@ export const detailQuery = defineQueryHandler({
         const row = await fetchOne(db, jobRunsTable, { id: query.payload.runId });
         if (!row)
             return null;
-        // payload is stored encrypted under the triggering user's DEK (#799).
+        // payload is stored encrypted under the triggering user's DEK.
         if (typeof row["payload"] === "string") {
             row["payload"] = await decryptStoredPii(row["payload"], "payload", "job-run-detail");
         }
-        // error is stored encrypted under the triggering user's DEK (#2307),
+        // error is stored encrypted under the triggering user's DEK,
         // same mechanism as row.payload above.
         if (typeof row["error"] === "string") {
             row["error"] = await decryptStoredPii(row["error"], "error", "job-run-detail");
@@ -39,8 +39,8 @@ export const detailQuery = defineQueryHandler({
         const logs = await selectMany(db, jobRunLogsTable, { runId: query.payload.runId }, {
             orderBy: { col: "id", direction: "asc" },
         });
-        // message is stored encrypted under the triggering user's DEK (#2247),
-        // same mechanism as row.payload above. Bounded concurrency (#2307) —
+        // message is stored encrypted under the triggering user's DEK,
+        // same mechanism as row.payload above. Bounded concurrency —
         // unbounded Promise.all would fire one decrypt per log line at once
         // against the KMS adapter's pool.
         const decryptedLogs = await mapWithConcurrency(logs, KMS_POOL_CONCURRENCY, async (log) => {

package/dist/jobs/handlers/list.query.js

@@ -88,7 +88,7 @@ export const listQuery = defineQueryHandler({
         // countWhere reruns the SAME `where` without the limit — `rows.length` is
         // capped at the page size and would silently undercount the total.
         const total = query.payload.totalCount === true ? await countWhere(db, jobRunsTable, where) : undefined;
-        // payload/error are stored encrypted under the triggering user's DEK (#799, #2307).
+        // payload/error are stored encrypted under the triggering user's DEK.
         return {
             rows: await mapWithConcurrency(rows, KMS_POOL_CONCURRENCY, decryptRunRow),
             nextCursor: hasMore ? encodeCursor(String(offset + limit)) : null,

package/dist/jobs/handlers/projection-rebuild.job.js

@@ -4,7 +4,7 @@ import { rebuildProjectionOrMultiStream } from "@cosmicdrift/kumiko-framework/mi
 import * as z from "zod";
 export const projectionRebuildPayloadSchema = z.object({
     projection: z.string().min(1),
-    // Quarantine mode (#760): skip + dead-letter poison events instead of
+    // Quarantine mode: skip + dead-letter poison events instead of
     // failing the whole rebuild. Operator opt-in per run.
     skipApplyErrors: z.boolean().optional(),
 });

package/dist/jobs/handlers/reindex-entity.job.js

@@ -1,4 +1,4 @@
-// Manual, perTenant backfill job (#1206/#1215) — indexes existing rows for
+// Manual, perTenant backfill job — indexes existing rows for
 // an entity that only got `searchable: true` after rows already existed.
 // perTenant fan-out (job-runner.ts) also applies to a manual dispatch, not
 // just cron: one `jobs:write:trigger` call with { entity } re-runs once per

package/dist/jobs/handlers/retry.write.js

@@ -35,7 +35,7 @@ export const retryWrite = defineWriteHandler({
                 details: { status: run.status },
             }));
         }
-        // payload is stored encrypted under the triggering user's DEK (#799),
+        // payload is stored encrypted under the triggering user's DEK,
         // same mechanism as detail.query.ts/list.query.ts — decrypt before
         // parsing it as JSON. A key erased since the run finished decrypts to
         // PII_ERASED_SENTINEL, which is not JSON; reject the retry rather than

package/dist/jobs/job-instant.js

@@ -1,5 +1,5 @@
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-// kumiko-framework#1525: the five value-position Temporal.Instant.from
+// The five value-position Temporal.Instant.from
 // call sites in feature.ts live inside defineApply callbacks with no
 // exported seam, so this thin wrapper gives the ambient-global-independence
 // regression test something to import directly.