@cosmicdrift/kumiko-bundled-features 0.386.0 → 0.388.0

package/dist/inbound-provider-imap/imap-client.js

@@ -1,6 +1,6 @@
-// imapflow-Wiring + pure Helpers des IMAP-Providers.
-// Referenz-Impl: /Users/marc/code/doc-o-mat (HEINZ) — aber inkrementeller
-// UIDVALIDITY:lastUid-Cursor statt '1:*'-Vollscan.
+// imapflow wiring and pure helpers for IMAP providers.
+// Reference implementation: /Users/marc/code/doc-o-mat (HEINZ), but uses an
+// incremental UIDVALIDITY:lastUid cursor instead of a '1:*' full scan.
 import { BlockedHostError, readAllowedPrivateMailHostsFromEnv, resolveMailConnectTarget, } from "@cosmicdrift/kumiko-bundled-features/foundation-shared";
 import { InboundAuthError, InboundCursorInvalidError, InboundTransientError, } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
@@ -71,9 +71,9 @@ export async function createImapClient(doc, hostGuard = {}) {
 }
 /** Server-Fehler → typisierte Foundation-Fehlerklassen (Plan §2). */
 export function mapImapError(err, host) {
-    // imapflow-Fehler tragen die Server-Antwort in responseText, die
-    // message ist nur "Command failed" — beides in den Match einbeziehen;
-    // authenticationFailed ist das verlässliche Flag.
+    // imapflow errors carry the server response in responseText; the
+    // message is only "Command failed", so both are included in the match;
+    // authenticationFailed is the reliable flag.
     const carrier = isPlainObject(err) ? err : undefined;
     const responseText = typeof carrier?.["responseText"] === "string" ? carrier["responseText"] : "";
     const msg = `${err instanceof Error ? err.message : String(err)} ${responseText}`.trim();
@@ -95,9 +95,9 @@ export function parseImapCursor(cursor) {
         return null;
     return { uidValidity, lastUid };
 }
-/** Wirft InboundCursorInvalidError bei UIDVALIDITY-Wechsel — die
- *  Foundation resettet den Cursor und macht einen Voll-Resync im
- *  Backfill-Fenster (Dedup fängt Dubletten). */
+/** Throws InboundCursorInvalidError when UIDVALIDITY changes; the
+ *  foundation resets the cursor and performs a full resync within the
+ *  backfill window (deduplication catches duplicates). */
 export function assertUidValidity(cursor, serverUidValidity) {
     if (cursor && cursor.uidValidity !== serverUidValidity) {
         throw new InboundCursorInvalidError(`UIDVALIDITY changed (${cursor.uidValidity} → ${serverUidValidity}) — full resync required`);
@@ -109,8 +109,9 @@ export function assertUidValidity(cursor, serverUidValidity) {
 function stripAngles(id) {
     return id.replace(/^<|>$/g, "").trim();
 }
-/** References-Chain normalisieren: mailparser liefert string | string[]
- *  | undefined; fehlt References, trägt In-Reply-To den Thread-Anker. */
+/** Normalizes the References chain: mailparser returns string | string[]
+ *  | undefined; when References is missing, In-Reply-To provides the thread
+ *  anchor. */
 export function normalizeReferences(parsed) {
     const raw = parsed.references;
     const list = raw === undefined ? [] : Array.isArray(raw) ? raw : raw.split(/\s+/);
@@ -128,15 +129,15 @@ function addressList(a) {
     const arr = Array.isArray(a) ? a : [a];
     return arr.map((x) => x.text).filter((t) => Boolean(t));
 }
-/** imapflow liefert internalDate je nach Codepfad als Date ODER string.
- *  String-Form verwerfen wir bewusst (kein Date-Parsing im Feature-Code,
- *  no-date-api) — toRawInboundMessage fällt dann auf mailparsers
- *  Date-Header zurück, der immer als echtes Date kommt. */
+/** imapflow provides internalDate as either a Date or string depending on
+ *  the code path. The string form is deliberately discarded (no date parsing
+ *  in feature code, no-date-api); toRawInboundMessage then falls back to the
+ *  mailparser Date header, which is always a real Date. */
 export function coerceDate(d) {
     return d instanceof Date ? d : undefined;
 }
-/** providerMessageId: UID ist nur innerhalb einer UIDVALIDITY eindeutig
- *  — beides zusammen ist der stabile Idempotency-Anchor. */
+/** providerMessageId: a UID is unique only within a UIDVALIDITY; together,
+ *  they form the stable idempotency anchor. */
 export function buildProviderMessageId(uidValidity, uid) {
     return `${uidValidity}:${uid}`;
 }
@@ -155,8 +156,8 @@ export async function toRawInboundMessage(args) {
         cc: addressList(parsed.cc),
         subject: parsed.subject ?? "",
         snippet: text.slice(0, SNIPPET_MAX),
-        // Lib-Boundary-Bridge (Date von imapflow/mailparser) → Temporal;
-        // fehlt jedes Datum, ist Epoch der ehrliche Marker.
+        // Lib-boundary bridge (Date from imapflow/mailparser) → Temporal;
+        // when no date exists, Epoch is the honest marker.
         receivedAtIso: (receivedAt
             ? legacyDateToInstant(receivedAt)
             : Temporal.Instant.fromEpochMilliseconds(0)).toString(),

package/dist/inbound-provider-inmemory/feature.d.ts

@@ -1,18 +1,18 @@
 import type { InboundMailProviderPlugin, RawInboundMessage } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
 export declare const INMEMORY_PROVIDER_KEY = "inmemory";
-/** Test-Helper: Message ins Postfach legen. Läuft ein watch, wird sie
- *  sofort gepusht (IDLE-Simulation); der nächste fetch liefert sie
- *  cursor-basiert ebenfalls — Dedup der Foundation macht das idempotent. */
+/** Test helper: adds a message to the mailbox. If a watch is active, it is
+ *  pushed immediately (IDLE simulation); the next fetch also returns it by
+ *  cursor — the foundation's deduplication makes this idempotent. */
 export declare function seedInboundMessage(accountId: string, msg: RawInboundMessage): Promise<void>;
-/** Test-Helper: One-Shot-Fehler für den nächsten fetch (z.B.
- *  InboundAuthError, InboundCursorInvalidError). */
+/** Test helper: injects a one-shot error into the next fetch (e.g.
+ *  InboundAuthError or InboundCursorInvalidError). */
 export declare function failNextFetchWith(accountId: string, err: unknown): void;
-/** Test-Helper: One-Shot-Fehler für das nächste verify. */
+/** Test helper: injects a one-shot error into the next verify. */
 export declare function failNextVerifyWith(accountId: string, err: unknown): void;
-/** Test-Helper: Tod der Live-Verbindung simulieren (Supervisor muss
- *  mit Backoff neu starten). */
+/** Test helper: simulates the live connection terminating (the supervisor
+ *  must restart with backoff). */
 export declare function emitWatchError(accountId: string, err: unknown): void;
-/** Test-Helper: läuft gerade ein watch für den Account? */
+/** Test helper: reports whether an account currently has an active watch. */
 export declare function isWatching(accountId: string): boolean;
 /** Test-Helper: kompletter State-Reset (Test-Isolation — Mock-States
  *  nie zwischen Tests teilen). */

package/dist/inbound-provider-inmemory/feature.js

@@ -1,15 +1,15 @@
 // kumiko-feature-version: 1
 //
-// inbound-provider-inmemory — scriptbarer In-Memory-Provider für die
-// inbound-mail-foundation Plugin-API. Für Tests, Demos und Sample-Apps:
-// Messages werden per `seedInboundMessage()` eingespeist statt von einem
-// echten Postfach gefetcht; `watch()` pusht geseedete Messages sofort
-// (IDLE-Simulation), `fetch()` liefert sie cursor-basiert nach
-// (Reconciliation-Pfad) — beide Pfade zusammen exercisen exakt die
-// Dedup-Garantie der Foundation.
+// inbound-provider-inmemory — scriptable in-memory provider for the
+// inbound-mail-foundation plugin API. For tests, demos, and sample apps:
+// messages are supplied via `seedInboundMessage()` instead of being fetched
+// from a real mailbox; `watch()` immediately pushes seeded messages
+// (IDLE simulation), while `fetch()` returns them by cursor
+// (reconciliation path). Together, both paths exercise the foundation's
+// deduplication guarantee exactly.
 //
-// **Pattern-Vorbild:** mail-transport-inmemory (module-level State +
-// Test-Helper-Exports). NICHT für Production.
+// **Pattern basis:** mail-transport-inmemory (module-level state +
+// test-helper exports). Not for production.
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 const FEATURE_NAME = "inbound-provider-inmemory";
 export const INMEMORY_PROVIDER_KEY = "inmemory";
@@ -22,26 +22,26 @@ function stateFor(accountId) {
     }
     return state;
 }
-/** Test-Helper: Message ins Postfach legen. Läuft ein watch, wird sie
- *  sofort gepusht (IDLE-Simulation); der nächste fetch liefert sie
- *  cursor-basiert ebenfalls — Dedup der Foundation macht das idempotent. */
+/** Test helper: adds a message to the mailbox. If a watch is active, it is
+ *  pushed immediately (IDLE simulation); the next fetch also returns it by
+ *  cursor — the foundation's deduplication makes this idempotent. */
 export async function seedInboundMessage(accountId, msg) {
     const state = stateFor(accountId);
     state.log.push(msg);
     if (state.watch)
         await state.watch.onMessages([msg]);
 }
-/** Test-Helper: One-Shot-Fehler für den nächsten fetch (z.B.
- *  InboundAuthError, InboundCursorInvalidError). */
+/** Test helper: injects a one-shot error into the next fetch (e.g.
+ *  InboundAuthError or InboundCursorInvalidError). */
 export function failNextFetchWith(accountId, err) {
     stateFor(accountId).nextFetchError = err;
 }
-/** Test-Helper: One-Shot-Fehler für das nächste verify. */
+/** Test helper: injects a one-shot error into the next verify. */
 export function failNextVerifyWith(accountId, err) {
     stateFor(accountId).nextVerifyError = err;
 }
-/** Test-Helper: Tod der Live-Verbindung simulieren (Supervisor muss
- *  mit Backoff neu starten). */
+/** Test helper: simulates the live connection terminating (the supervisor
+ *  must restart with backoff). */
 export function emitWatchError(accountId, err) {
     const state = accounts.get(accountId);
     if (state?.watch) {
@@ -50,7 +50,7 @@ export function emitWatchError(accountId, err) {
         handlers.onError(err);
     }
 }
-/** Test-Helper: läuft gerade ein watch für den Account? */
+/** Test helper: reports whether an account currently has an active watch. */
 export function isWatching(accountId) {
     return accounts.get(accountId)?.watch != null;
 }
@@ -60,7 +60,7 @@ export function resetInboundInMemory() {
     accounts.clear();
 }
 // =============================================================================
-// Plugin — cursor = { offset: number } über das append-only-Log.
+// Plugin — cursor = { offset: number } over the append-only log.
 // =============================================================================
 function offsetOf(cursor) {
     const raw = cursor?.["offset"];

package/dist/jobs/db/queries/retention.js

@@ -1,4 +1,4 @@
-// Job-run retention (#2243): store_job_runs/store_job_run_logs are
+// Job-run retention: store_job_runs/store_job_run_logs are
 // direct-write stores now, not event-sourced projections — nothing else
 // purges them, so without this query they grow forever with the run count
 // instead of the runtime. Not the retention-cleanup executor: that executor
@@ -18,7 +18,7 @@ export async function deleteStaleJobRuns(db, retentionDays) {
     const cutoff = Temporal.Now.instant().subtract({ hours: retentionDays * 24 });
     const logsResult = await deleteManyBatched(db, jobRunLogsTable, { timestamp: { lt: cutoff } }, { limit: RETENTION_DELETE_BATCH_SIZE });
     const runsResult = await deleteManyBatched(db, jobRunsTable, { insertedAt: { lt: cutoff } }, { limit: RETENTION_DELETE_BATCH_SIZE });
-    // Same window for the tenant-visible failure records (fw#3079): the run
+    // Same window for the tenant-visible failure records: the run
     // they point at is gone by now, and a job whose subject never ran again
     // would otherwise keep its record forever.
     const tenantFailuresResult = await deleteManyBatched(db, tenantJobFailuresTable, { failedAt: { lt: cutoff } }, { limit: RETENTION_DELETE_BATCH_SIZE });

package/dist/jobs/db/queries/stale-run-sweep.js

@@ -1,5 +1,5 @@
-// Stale job-run sweep (#2246): store_job_runs is a direct-write store
-// (#2243) — status is set to "running" once at onJobStart and only ever
+// Stale job-run sweep: store_job_runs is a direct-write store
+// Status is set to "running" once at onJobStart and only ever
 // flipped to "completed"/"failed" by onJobComplete/onJobFailed. If the
 // process dies mid-run (crash, OOM, kill -9), those callbacks never fire and
 // the row is stuck on "running" forever — nothing else on the read side
@@ -31,7 +31,7 @@ export async function markStaleJobRunsFailed(db, timeoutHours, queuedRetentionDa
     // user subject annotation as job-run-logger.ts's onJobFailed path
     // (personal: { of: "triggeredById" } on job-run-table.ts), so it is encrypted
     // under the triggering user's DEK, or the system tenant key when
-    // triggeredById is null (whenAbsent: "tenant", fw#3654). Runs are grouped by
+    // triggeredById is null (whenAbsent: "tenant"). Runs are grouped by
     // that subject: one encrypt and one updateMany per subject instead of per run.
     const stale = await selectMany(db, jobRunsTable, {
         status: "running",

package/dist/jobs/events.js

@@ -1,4 +1,4 @@
-// Payload schemas for the jobRun direct-write path (#2243). Pre-#2243 these
+// Payload schemas for the jobRun direct-write path. Previously these
 // backed jobRun's event-store payloads (r.defineEvent + inline projections);
 // now job-run-logger.ts parses against them before writing straight into
 // jobRunsTable/jobRunLogsTable, so an out-of-dispatcher write still gets the

package/dist/jobs/feature.d.ts

@@ -2,5 +2,6 @@ import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 export type JobsFeatureOptions = {
     readonly retentionDays?: number;
     readonly staleRunTimeoutHours?: number;
+    readonly readRoles?: readonly string[];
 };
 export declare function createJobsFeature(options?: JobsFeatureOptions): FeatureDefinition;

package/dist/jobs/feature.js

@@ -9,8 +9,8 @@ import { reindexEntityJob, reindexEntityPayloadSchema } from "./handlers/reindex
 import { createRetentionCleanupJob, DEFAULT_JOB_RUN_RETENTION_DAYS, } from "./handlers/retention-cleanup.job.js";
 import { retryWrite } from "./handlers/retry.write.js";
 import { createStaleRunSweepJob, DEFAULT_JOB_RUN_STALE_TIMEOUT_HOURS, } from "./handlers/stale-run-sweep.job.js";
-import { tenantFailuresQuery } from "./handlers/tenant-failures.query.js";
-import { tenantRunsQuery } from "./handlers/tenant-runs.query.js";
+import { createTenantFailuresQuery } from "./handlers/tenant-failures.query.js";
+import { createTenantRunsQuery } from "./handlers/tenant-runs.query.js";
 import { triggerWrite } from "./handlers/trigger.write.js";
 import { jobRunLogsTableMeta, jobRunsTableMeta } from "./job-run-table.js";
 import { eventConsumerDetailScreen, eventConsumersScreen, jobRunDetailScreen, jobRunsScreen, jobTriggerScreen, } from "./screens.js";
@@ -20,6 +20,10 @@ import { JOBS_I18N } from "./web/i18n.js";
 export function createJobsFeature(options = {}) {
     const retentionDays = options.retentionDays ?? DEFAULT_JOB_RUN_RETENTION_DAYS;
     const staleRunTimeoutHours = options.staleRunTimeoutHours ?? DEFAULT_JOB_RUN_STALE_TIMEOUT_HOURS;
+    const readRoles = options.readRoles ?? [];
+    if (readRoles.includes("anonymous")) {
+        throw new Error(`createJobsFeature: readRoles must not contain "anonymous" — job status and failures are only readable by members of the tenant.`);
+    }
     return defineFeature("jobs", (r) => {
         r.describe("Persistence and operator tooling for background jobs registered via `r.job(...)`. Every job execution writes directly into `store_job_runs` (current status + duration) and `store_job_run_logs` (per-line log rows) from the BullMQ callbacks — no event stream in between (#2243). A daily `retention-cleanup` job deletes runs (and their logs) older than `retentionDays`; an hourly `stale-run-sweep` job marks runs stuck at status `running` past `staleRunTimeoutHours` as `failed` (#2246 — a crashed worker never fires the completion callback, so nothing else ever revisits the row). Exposes `jobs:write:trigger` (manual run) and `jobs:write:retry` (operator retry of a failed run), plus `jobs:query:list`, `jobs:query:details`, and `jobs:query:catalog` (manual jobs) for the operator UI. A job that declares `tenantVisibleFailure` also records its last failed attempt per tenant and subject in `store_tenant_job_failures`, which the tenant itself reads through `jobs:query:failures` — a translation key only, never the provider's message (fw#3079). A job that declares `tenantVisibleRun` also keeps its run state per tenant and subject in `store_tenant_job_runs` (queued, running, plus the latest completed or failed run, no payload, error text or logs), which the tenant reads through `jobs:query:tenant-runs` (fw#3616); the stale-run sweep fails its stuck `running` rows and drops `queued` rows older than `retentionDays`.");
         r.uiHints({
@@ -31,11 +35,10 @@ export function createJobsFeature(options = {}) {
         r.storeTable(jobRunsTableMeta, {
             reason: "direct_write.job_runs",
             // payload/error carry personal:{of:"triggeredById"} (job-run-table.ts): encrypted under the
-            // triggering user's DEK, or the system tenant key when triggeredById is null
-            // (whenAbsent: "tenant", fw#3654).
+            // triggering user's DEK, or the system tenant key when triggeredById is null.
             // job-run-logger.ts manually encrypts both before every insert/update
             // (encryptStartedPayload/encryptFailureError) since this store bypasses
-            // the executor's automatic PII pipeline (#2243).
+            // the executor's automatic PII pipeline.
             piiEncryptedOnWrite: true,
         });
         r.storeTable(jobRunLogsTableMeta, {
@@ -49,7 +52,7 @@ export function createJobsFeature(options = {}) {
         });
         // Framework-provided rebuild job — available whenever `jobs` is composed; enqueueProjectionRebuild dispatches it.
         r.job("projectionRebuild", { trigger: { manual: true }, concurrency: "skip", schema: projectionRebuildPayloadSchema }, projectionRebuildJob);
-        // Retroactive search backfill (#1206/#1215) — manual + perTenant, so one
+        // Retroactive search backfill — manual + perTenant, so one
         // `jobs:write:trigger` call with { entity } fans out to every active
         // tenant (job-runner.ts perTenant dispatch applies to manual triggers
         // too, not just cron).
@@ -60,10 +63,10 @@ export function createJobsFeature(options = {}) {
             schema: reindexEntityPayloadSchema,
         }, reindexEntityJob);
         // store_job_runs/store_job_run_logs are direct-write, unbounded-growth
-        // stores (#2243) — nothing else purges them.
+        // stores — nothing else purges them.
         r.job("retention-cleanup", { trigger: { cron: "0 3 * * *" }, concurrency: "skip" }, createRetentionCleanupJob(retentionDays));
         // Sweeps store_job_runs for rows stuck at status "running" past the
-        // timeout (#2246). Hourly matches the timeout's own granularity —
+        // timeout. Hourly matches the timeout's own granularity —
         // frequent enough to catch a stuck run soon after it crosses the
         // threshold, cheap enough that an (almost always empty) result set
         // doesn't matter.
@@ -80,8 +83,8 @@ export function createJobsFeature(options = {}) {
             list: r.queryHandler(listQuery),
             detail: r.queryHandler(detailQuery),
             catalog: r.queryHandler(catalogQuery),
-            failures: r.queryHandler(tenantFailuresQuery),
-            tenantRuns: r.queryHandler(tenantRunsQuery),
+            failures: r.queryHandler(createTenantFailuresQuery(readRoles)),
+            tenantRuns: r.queryHandler(createTenantRunsQuery(readRoles)),
             consumers: r.queryHandler(consumersQuery),
             consumerDetails: r.queryHandler(consumerDetailQuery),
         };

package/dist/jobs/handlers/detail.query.js

@@ -27,11 +27,11 @@ export const detailQuery = defineQueryHandler({
         const row = await fetchOne(db, jobRunsTable, { id: query.payload.runId });
         if (!row)
             return null;
-        // payload is stored encrypted under the triggering user's DEK (#799).
+        // payload is stored encrypted under the triggering user's DEK.
         if (typeof row["payload"] === "string") {
             row["payload"] = await decryptStoredPii(row["payload"], "payload", "job-run-detail");
         }
-        // error is stored encrypted under the triggering user's DEK (#2307),
+        // error is stored encrypted under the triggering user's DEK,
         // same mechanism as row.payload above.
         if (typeof row["error"] === "string") {
             row["error"] = await decryptStoredPii(row["error"], "error", "job-run-detail");
@@ -39,8 +39,8 @@ export const detailQuery = defineQueryHandler({
         const logs = await selectMany(db, jobRunLogsTable, { runId: query.payload.runId }, {
             orderBy: { col: "id", direction: "asc" },
         });
-        // message is stored encrypted under the triggering user's DEK (#2247),
-        // same mechanism as row.payload above. Bounded concurrency (#2307) —
+        // message is stored encrypted under the triggering user's DEK,
+        // same mechanism as row.payload above. Bounded concurrency —
         // unbounded Promise.all would fire one decrypt per log line at once
         // against the KMS adapter's pool.
         const decryptedLogs = await mapWithConcurrency(logs, KMS_POOL_CONCURRENCY, async (log) => {

package/dist/jobs/handlers/list.query.js

@@ -88,7 +88,7 @@ export const listQuery = defineQueryHandler({
         // countWhere reruns the SAME `where` without the limit — `rows.length` is
         // capped at the page size and would silently undercount the total.
         const total = query.payload.totalCount === true ? await countWhere(db, jobRunsTable, where) : undefined;
-        // payload/error are stored encrypted under the triggering user's DEK (#799, #2307).
+        // payload/error are stored encrypted under the triggering user's DEK.
         return {
             rows: await mapWithConcurrency(rows, KMS_POOL_CONCURRENCY, decryptRunRow),
             nextCursor: hasMore ? encodeCursor(String(offset + limit)) : null,

package/dist/jobs/handlers/projection-rebuild.job.js

@@ -4,7 +4,7 @@ import { rebuildProjectionOrMultiStream } from "@cosmicdrift/kumiko-framework/mi
 import * as z from "zod";
 export const projectionRebuildPayloadSchema = z.object({
     projection: z.string().min(1),
-    // Quarantine mode (#760): skip + dead-letter poison events instead of
+    // Quarantine mode: skip + dead-letter poison events instead of
     // failing the whole rebuild. Operator opt-in per run.
     skipApplyErrors: z.boolean().optional(),
 });

package/dist/jobs/handlers/reindex-entity.job.js

@@ -1,4 +1,4 @@
-// Manual, perTenant backfill job (#1206/#1215) — indexes existing rows for
+// Manual, perTenant backfill job — indexes existing rows for
 // an entity that only got `searchable: true` after rows already existed.
 // perTenant fan-out (job-runner.ts) also applies to a manual dispatch, not
 // just cron: one `jobs:write:trigger` call with { entity } re-runs once per

package/dist/jobs/handlers/retry.write.js

@@ -35,7 +35,7 @@ export const retryWrite = defineWriteHandler({
                 details: { status: run.status },
             }));
         }
-        // payload is stored encrypted under the triggering user's DEK (#799),
+        // payload is stored encrypted under the triggering user's DEK,
         // same mechanism as detail.query.ts/list.query.ts — decrypt before
         // parsing it as JSON. A key erased since the run finished decrypts to
         // PII_ERASED_SENTINEL, which is not JSON; reject the retry rather than

package/dist/jobs/handlers/tenant-failures.query.d.ts

@@ -1,5 +1,5 @@
 import * as z from "zod";
-export declare const tenantFailuresQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"failures", z.ZodObject<{
+export declare function createTenantFailuresQuery(readRoles: readonly string[]): import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"failures", z.ZodObject<{
     jobName: z.ZodOptional<z.ZodString>;
     subject: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
     limit: z.ZodOptional<z.ZodNumber>;

package/dist/jobs/handlers/tenant-failures.query.js

@@ -20,45 +20,49 @@ function parseSubject(stored) {
         return null;
     return Object.fromEntries(parsed.filter(isSubjectEntry));
 }
-export const tenantFailuresQuery = defineQueryHandler({
-    name: "failures",
-    description: "Lists the calling tenant's own failed jobs — one record per job and subject, newest first, each carrying a translation key for the reason, never the provider's own error message; the optional subject filter matches exactly: all declared subjectFields with the same JSON types as the job payload; use it to tell a tenant that their asynchronous job failed instead of leaving the screen waiting.",
-    schema: z.object({
-        jobName: z.string().optional(),
-        subject: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).optional(),
-        limit: z.number().int().min(1).max(200).optional(),
-    }),
-    // Every membership rank: a failure record carries a job name and a
-    // translation key, nothing a team member of the tenant may not see.
-    access: { roles: access.roles("User", "Editor", ...access.admin) },
-    handler: async (query, ctx) => {
-        if (!ctx.systemDb) {
-            throw new InternalError({
-                message: "jobs:query:failures requires ctx.systemDb (feature must declare r.systemScope())",
+export function createTenantFailuresQuery(readRoles) {
+    return defineQueryHandler({
+        name: "failures",
+        description: "Lists the calling tenant's own failed jobs — one record per job and subject, newest first, each carrying a translation key for the reason, never the provider's own error message; the optional subject filter matches exactly: all declared subjectFields with the same JSON types as the job payload; use it to tell a tenant that their asynchronous job failed instead of leaving the screen waiting.",
+        schema: z.object({
+            jobName: z.string().optional(),
+            subject: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).optional(),
+            limit: z.number().int().min(1).max(200).optional(),
+        }),
+        // Every membership rank: a failure record carries a job name and a
+        // translation key, nothing a team member of the tenant may not see.
+        access: {
+            roles: [...new Set([...access.roles("User", "Editor", ...access.admin), ...readRoles])],
+        },
+        handler: async (query, ctx) => {
+            if (!ctx.systemDb) {
+                throw new InternalError({
+                    message: "jobs:query:failures requires ctx.systemDb (feature must declare r.systemScope())",
+                });
+            }
+            // assertTenantMatch is a self-check on the caller and returns the same
+            // unfiltered system-mode db (tenant-db.ts) — the explicit tenantId below
+            // is the filter, assertRowsTenant the second net. There is no
+            // cross-tenant mode here: SystemAdmin reads runs via jobs:query:list.
+            const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
+            const where = { tenantId: [query.user.tenantId] };
+            if (query.payload.jobName)
+                where["jobName"] = query.payload.jobName;
+            if (query.payload.subject)
+                where["subject"] = serializeJobSubject(query.payload.subject);
+            const rows = await selectMany(db, tenantJobFailuresTable, where, {
+                orderBy: { col: "failedAt", direction: "desc" },
+                limit: query.payload.limit ?? DEFAULT_LIMIT,
             });
-        }
-        // assertTenantMatch is a self-check on the caller and returns the same
-        // unfiltered system-mode db (tenant-db.ts) — the explicit tenantId below
-        // is the filter, assertRowsTenant the second net. There is no
-        // cross-tenant mode here: SystemAdmin reads runs via jobs:query:list.
-        const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
-        const where = { tenantId: [query.user.tenantId] };
-        if (query.payload.jobName)
-            where["jobName"] = query.payload.jobName;
-        if (query.payload.subject)
-            where["subject"] = serializeJobSubject(query.payload.subject);
-        const rows = await selectMany(db, tenantJobFailuresTable, where, {
-            orderBy: { col: "failedAt", direction: "desc" },
-            limit: query.payload.limit ?? DEFAULT_LIMIT,
-        });
-        return {
-            rows: ctx.systemDb.assertRowsTenant(rows, "tenantId").map((row) => ({
-                jobName: row.jobName,
-                subject: parseSubject(row.subject),
-                messageKey: row.messageKey,
-                failedAt: row.failedAt,
-            })),
-            nextCursor: null,
-        };
-    },
-});
+            return {
+                rows: ctx.systemDb.assertRowsTenant(rows, "tenantId").map((row) => ({
+                    jobName: row.jobName,
+                    subject: parseSubject(row.subject),
+                    messageKey: row.messageKey,
+                    failedAt: row.failedAt,
+                })),
+                nextCursor: null,
+            };
+        },
+    });
+}

package/dist/jobs/handlers/tenant-runs.query.d.ts

@@ -1,6 +1,6 @@
 import * as z from "zod";
 import { type TenantJobRunStatus } from "../tenant-job-run-table.ts";
-export declare const tenantRunsQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"tenant-runs", z.ZodObject<{
+export declare function createTenantRunsQuery(readRoles: readonly string[]): import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"tenant-runs", z.ZodObject<{
     jobName: z.ZodOptional<z.ZodString>;
     subject: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
     limit: z.ZodOptional<z.ZodNumber>;

package/dist/jobs/handlers/tenant-runs.query.js

@@ -19,54 +19,58 @@ function parseSubject(stored) {
         return null;
     return Object.fromEntries(parsed.filter(isSubjectEntry));
 }
-export const tenantRunsQuery = defineQueryHandler({
-    name: "tenant-runs",
-    description: "Lists the calling tenant's own job runs that opted in via tenantVisibleRun — per job and subject every queued or running run plus the latest completed or failed one, active runs first, then newest first; each row carries only status and queuedAt/startedAt/finishedAt, never payloads, error text or logs; the optional subject filter matches exactly: all declared subjectFields with the same JSON types as the job payload; use it to show whether work for a subject is waiting, running or done, and to tell a failed run from a finished one.",
-    schema: z.object({
-        jobName: z.string().optional(),
-        subject: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).optional(),
-        limit: z.number().int().min(1).max(200).optional(),
-    }),
-    // Every membership rank: a run state carries a job name, a status and
-    // times, nothing a team member of the tenant may not see.
-    access: { roles: access.roles("User", "Editor", ...access.admin) },
-    handler: async (query, ctx) => {
-        if (!ctx.systemDb) {
-            throw new InternalError({
-                message: "jobs:query:tenant-runs requires ctx.systemDb (feature must declare r.systemScope())",
+export function createTenantRunsQuery(readRoles) {
+    return defineQueryHandler({
+        name: "tenant-runs",
+        description: "Lists the calling tenant's own job runs that opted in via tenantVisibleRun — per job and subject every queued or running run plus the latest completed or failed one, active runs first, then newest first; each row carries only status and queuedAt/startedAt/finishedAt, never payloads, error text or logs; the optional subject filter matches exactly: all declared subjectFields with the same JSON types as the job payload; use it to show whether work for a subject is waiting, running or done, and to tell a failed run from a finished one.",
+        schema: z.object({
+            jobName: z.string().optional(),
+            subject: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).optional(),
+            limit: z.number().int().min(1).max(200).optional(),
+        }),
+        // Every membership rank: a run state carries a job name, a status and
+        // times, nothing a team member of the tenant may not see.
+        access: {
+            roles: [...new Set([...access.roles("User", "Editor", ...access.admin), ...readRoles])],
+        },
+        handler: async (query, ctx) => {
+            if (!ctx.systemDb) {
+                throw new InternalError({
+                    message: "jobs:query:tenant-runs requires ctx.systemDb (feature must declare r.systemScope())",
+                });
+            }
+            // assertTenantMatch returns the same unfiltered system-mode db — the
+            // explicit tenantId below is the filter, assertRowsTenant the second net.
+            const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
+            const where = { tenantId: [query.user.tenantId] };
+            if (query.payload.jobName)
+                where["jobName"] = query.payload.jobName;
+            if (query.payload.subject)
+                where["subject"] = serializeJobSubject(query.payload.subject);
+            const limit = query.payload.limit ?? DEFAULT_LIMIT;
+            const newestFirst = { col: "updatedAt", direction: "desc" };
+            const activeRows = await selectMany(db, tenantJobRunsTable, { ...where, status: { in: ["queued", "running"] } }, { orderBy: newestFirst, limit });
+            const finishedRows = await selectMany(db, tenantJobRunsTable, { ...where, status: { in: ["completed", "failed"] } }, { orderBy: newestFirst, limit });
+            const seenFinishedKeys = new Set();
+            const finishedNewestPerKey = finishedRows.filter((row) => {
+                const key = JSON.stringify([row.jobName, row.subject]);
+                if (seenFinishedKeys.has(key))
+                    return false;
+                seenFinishedKeys.add(key);
+                return true;
             });
-        }
-        // assertTenantMatch returns the same unfiltered system-mode db — the
-        // explicit tenantId below is the filter, assertRowsTenant the second net.
-        const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
-        const where = { tenantId: [query.user.tenantId] };
-        if (query.payload.jobName)
-            where["jobName"] = query.payload.jobName;
-        if (query.payload.subject)
-            where["subject"] = serializeJobSubject(query.payload.subject);
-        const limit = query.payload.limit ?? DEFAULT_LIMIT;
-        const newestFirst = { col: "updatedAt", direction: "desc" };
-        const activeRows = await selectMany(db, tenantJobRunsTable, { ...where, status: { in: ["queued", "running"] } }, { orderBy: newestFirst, limit });
-        const finishedRows = await selectMany(db, tenantJobRunsTable, { ...where, status: { in: ["completed", "failed"] } }, { orderBy: newestFirst, limit });
-        const seenFinishedKeys = new Set();
-        const finishedNewestPerKey = finishedRows.filter((row) => {
-            const key = JSON.stringify([row.jobName, row.subject]);
-            if (seenFinishedKeys.has(key))
-                return false;
-            seenFinishedKeys.add(key);
-            return true;
-        });
-        const activeFirst = [...activeRows, ...finishedNewestPerKey];
-        return {
-            rows: ctx.systemDb.assertRowsTenant(activeFirst.slice(0, limit), "tenantId").map((row) => ({
-                jobName: row.jobName,
-                subject: parseSubject(row.subject),
-                status: row.status,
-                queuedAt: row.queuedAt,
-                startedAt: row.startedAt,
-                finishedAt: row.finishedAt,
-            })),
-            nextCursor: null,
-        };
-    },
-});
+            const activeFirst = [...activeRows, ...finishedNewestPerKey];
+            return {
+                rows: ctx.systemDb.assertRowsTenant(activeFirst.slice(0, limit), "tenantId").map((row) => ({
+                    jobName: row.jobName,
+                    subject: parseSubject(row.subject),
+                    status: row.status,
+                    queuedAt: row.queuedAt,
+                    startedAt: row.startedAt,
+                    finishedAt: row.finishedAt,
+                })),
+                nextCursor: null,
+            };
+        },
+    });
+}

package/dist/jobs/job-instant.js

@@ -1,5 +1,5 @@
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-// kumiko-framework#1525: the five value-position Temporal.Instant.from
+// The five value-position Temporal.Instant.from
 // call sites in feature.ts live inside defineApply callbacks with no
 // exported seam, so this thin wrapper gives the ambient-global-independence
 // regression test something to import directly.