@cosmicdrift/kumiko-bundled-features 0.387.0 → 0.388.0

package/dist/inbound-mail-foundation/watch-supervisor.js

@@ -66,6 +66,7 @@ const DEFAULT_WATCH_LEASE_TTL_SECONDS = 90;
 /** One cursor per account (one mailbox inbox) for now; multi-folder support
  *  can add further scopes later without a schema change. */
 const CURSOR_SCOPE = "default";
+const SEEN_LOOKUP_CHUNK_SIZE = 1000;
 export function createInboundMailSupervisor(deps) {
     const pollIntervalMs = deps.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
     const backfillWindowDays = deps.backfillWindowDays ?? DEFAULT_BACKFILL_WINDOW_DAYS;
@@ -112,11 +113,20 @@ export function createInboundMailSupervisor(deps) {
         const piiKms = configuredPiiSubjectKms();
         const records = [];
         for (const row of rows) {
-            const decrypted = piiKms
-                ? await decryptPiiFieldValues(row, MAIL_ACCOUNT_PII_FIELDS, piiKms, {
-                    requestId: "inbound-mail-foundation:supervisor:list-accounts",
-                })
-                : row;
+            let decrypted;
+            try {
+                decrypted = piiKms
+                    ? await decryptPiiFieldValues(row, MAIL_ACCOUNT_PII_FIELDS, piiKms, {
+                        requestId: "inbound-mail-foundation:supervisor:list-accounts",
+                    })
+                    : row;
+            }
+            catch (error) {
+                // Class name only: the message may carry ciphertext or key details.
+                const errorName = error instanceof Error ? error.name : "unknown error";
+                log(`inbound-mail: account ${row.id} skipped — address did not decrypt (${errorName})`);
+                continue;
+            }
             const decryptedAddress = decrypted["address"];
             // Falling back to row.address would hand the ciphertext to a provider.
             // One undecryptable account must not stop polling of every other tenant's accounts.
@@ -258,12 +268,19 @@ export function createInboundMailSupervisor(deps) {
         return async (providerMessageIds) => {
             if (providerMessageIds.length === 0)
                 return new Set();
-            const seen = await selectMany(deps.db, seenMessageTable, {
-                tenantId: account.tenantId,
-                accountId: account.id,
-                providerMessageId: { in: providerMessageIds },
-            }, { fields: ["providerMessageId"] });
-            const seenIds = new Set(seen.map((row) => row.providerMessageId));
+            // One bind parameter per id: a full-mailbox listing would exceed Postgres' 65535 limit.
+            const seenIds = new Set();
+            for (let start = 0; start < providerMessageIds.length; start += SEEN_LOOKUP_CHUNK_SIZE) {
+                const seen = await selectMany(deps.db, seenMessageTable, {
+                    tenantId: account.tenantId,
+                    accountId: account.id,
+                    providerMessageId: {
+                        in: providerMessageIds.slice(start, start + SEEN_LOOKUP_CHUNK_SIZE),
+                    },
+                }, { fields: ["providerMessageId"] });
+                for (const row of seen)
+                    seenIds.add(row.providerMessageId);
+            }
             return new Set(providerMessageIds.filter((id) => !seenIds.has(id)));
         };
     }

package/dist/jobs/feature.d.ts

@@ -2,5 +2,6 @@ import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 export type JobsFeatureOptions = {
     readonly retentionDays?: number;
     readonly staleRunTimeoutHours?: number;
+    readonly readRoles?: readonly string[];
 };
 export declare function createJobsFeature(options?: JobsFeatureOptions): FeatureDefinition;

package/dist/jobs/feature.js

@@ -9,8 +9,8 @@ import { reindexEntityJob, reindexEntityPayloadSchema } from "./handlers/reindex
 import { createRetentionCleanupJob, DEFAULT_JOB_RUN_RETENTION_DAYS, } from "./handlers/retention-cleanup.job.js";
 import { retryWrite } from "./handlers/retry.write.js";
 import { createStaleRunSweepJob, DEFAULT_JOB_RUN_STALE_TIMEOUT_HOURS, } from "./handlers/stale-run-sweep.job.js";
-import { tenantFailuresQuery } from "./handlers/tenant-failures.query.js";
-import { tenantRunsQuery } from "./handlers/tenant-runs.query.js";
+import { createTenantFailuresQuery } from "./handlers/tenant-failures.query.js";
+import { createTenantRunsQuery } from "./handlers/tenant-runs.query.js";
 import { triggerWrite } from "./handlers/trigger.write.js";
 import { jobRunLogsTableMeta, jobRunsTableMeta } from "./job-run-table.js";
 import { eventConsumerDetailScreen, eventConsumersScreen, jobRunDetailScreen, jobRunsScreen, jobTriggerScreen, } from "./screens.js";
@@ -20,6 +20,10 @@ import { JOBS_I18N } from "./web/i18n.js";
 export function createJobsFeature(options = {}) {
     const retentionDays = options.retentionDays ?? DEFAULT_JOB_RUN_RETENTION_DAYS;
     const staleRunTimeoutHours = options.staleRunTimeoutHours ?? DEFAULT_JOB_RUN_STALE_TIMEOUT_HOURS;
+    const readRoles = options.readRoles ?? [];
+    if (readRoles.includes("anonymous")) {
+        throw new Error(`createJobsFeature: readRoles must not contain "anonymous" — job status and failures are only readable by members of the tenant.`);
+    }
     return defineFeature("jobs", (r) => {
         r.describe("Persistence and operator tooling for background jobs registered via `r.job(...)`. Every job execution writes directly into `store_job_runs` (current status + duration) and `store_job_run_logs` (per-line log rows) from the BullMQ callbacks — no event stream in between (#2243). A daily `retention-cleanup` job deletes runs (and their logs) older than `retentionDays`; an hourly `stale-run-sweep` job marks runs stuck at status `running` past `staleRunTimeoutHours` as `failed` (#2246 — a crashed worker never fires the completion callback, so nothing else ever revisits the row). Exposes `jobs:write:trigger` (manual run) and `jobs:write:retry` (operator retry of a failed run), plus `jobs:query:list`, `jobs:query:details`, and `jobs:query:catalog` (manual jobs) for the operator UI. A job that declares `tenantVisibleFailure` also records its last failed attempt per tenant and subject in `store_tenant_job_failures`, which the tenant itself reads through `jobs:query:failures` — a translation key only, never the provider's message (fw#3079). A job that declares `tenantVisibleRun` also keeps its run state per tenant and subject in `store_tenant_job_runs` (queued, running, plus the latest completed or failed run, no payload, error text or logs), which the tenant reads through `jobs:query:tenant-runs` (fw#3616); the stale-run sweep fails its stuck `running` rows and drops `queued` rows older than `retentionDays`.");
         r.uiHints({
@@ -79,8 +83,8 @@ export function createJobsFeature(options = {}) {
             list: r.queryHandler(listQuery),
             detail: r.queryHandler(detailQuery),
             catalog: r.queryHandler(catalogQuery),
-            failures: r.queryHandler(tenantFailuresQuery),
-            tenantRuns: r.queryHandler(tenantRunsQuery),
+            failures: r.queryHandler(createTenantFailuresQuery(readRoles)),
+            tenantRuns: r.queryHandler(createTenantRunsQuery(readRoles)),
             consumers: r.queryHandler(consumersQuery),
             consumerDetails: r.queryHandler(consumerDetailQuery),
         };

package/dist/jobs/handlers/tenant-failures.query.d.ts

@@ -1,5 +1,5 @@
 import * as z from "zod";
-export declare const tenantFailuresQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"failures", z.ZodObject<{
+export declare function createTenantFailuresQuery(readRoles: readonly string[]): import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"failures", z.ZodObject<{
     jobName: z.ZodOptional<z.ZodString>;
     subject: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
     limit: z.ZodOptional<z.ZodNumber>;

package/dist/jobs/handlers/tenant-failures.query.js

@@ -20,45 +20,49 @@ function parseSubject(stored) {
         return null;
     return Object.fromEntries(parsed.filter(isSubjectEntry));
 }
-export const tenantFailuresQuery = defineQueryHandler({
-    name: "failures",
-    description: "Lists the calling tenant's own failed jobs — one record per job and subject, newest first, each carrying a translation key for the reason, never the provider's own error message; the optional subject filter matches exactly: all declared subjectFields with the same JSON types as the job payload; use it to tell a tenant that their asynchronous job failed instead of leaving the screen waiting.",
-    schema: z.object({
-        jobName: z.string().optional(),
-        subject: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).optional(),
-        limit: z.number().int().min(1).max(200).optional(),
-    }),
-    // Every membership rank: a failure record carries a job name and a
-    // translation key, nothing a team member of the tenant may not see.
-    access: { roles: access.roles("User", "Editor", ...access.admin) },
-    handler: async (query, ctx) => {
-        if (!ctx.systemDb) {
-            throw new InternalError({
-                message: "jobs:query:failures requires ctx.systemDb (feature must declare r.systemScope())",
+export function createTenantFailuresQuery(readRoles) {
+    return defineQueryHandler({
+        name: "failures",
+        description: "Lists the calling tenant's own failed jobs — one record per job and subject, newest first, each carrying a translation key for the reason, never the provider's own error message; the optional subject filter matches exactly: all declared subjectFields with the same JSON types as the job payload; use it to tell a tenant that their asynchronous job failed instead of leaving the screen waiting.",
+        schema: z.object({
+            jobName: z.string().optional(),
+            subject: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).optional(),
+            limit: z.number().int().min(1).max(200).optional(),
+        }),
+        // Every membership rank: a failure record carries a job name and a
+        // translation key, nothing a team member of the tenant may not see.
+        access: {
+            roles: [...new Set([...access.roles("User", "Editor", ...access.admin), ...readRoles])],
+        },
+        handler: async (query, ctx) => {
+            if (!ctx.systemDb) {
+                throw new InternalError({
+                    message: "jobs:query:failures requires ctx.systemDb (feature must declare r.systemScope())",
+                });
+            }
+            // assertTenantMatch is a self-check on the caller and returns the same
+            // unfiltered system-mode db (tenant-db.ts) — the explicit tenantId below
+            // is the filter, assertRowsTenant the second net. There is no
+            // cross-tenant mode here: SystemAdmin reads runs via jobs:query:list.
+            const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
+            const where = { tenantId: [query.user.tenantId] };
+            if (query.payload.jobName)
+                where["jobName"] = query.payload.jobName;
+            if (query.payload.subject)
+                where["subject"] = serializeJobSubject(query.payload.subject);
+            const rows = await selectMany(db, tenantJobFailuresTable, where, {
+                orderBy: { col: "failedAt", direction: "desc" },
+                limit: query.payload.limit ?? DEFAULT_LIMIT,
             });
-        }
-        // assertTenantMatch is a self-check on the caller and returns the same
-        // unfiltered system-mode db (tenant-db.ts) — the explicit tenantId below
-        // is the filter, assertRowsTenant the second net. There is no
-        // cross-tenant mode here: SystemAdmin reads runs via jobs:query:list.
-        const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
-        const where = { tenantId: [query.user.tenantId] };
-        if (query.payload.jobName)
-            where["jobName"] = query.payload.jobName;
-        if (query.payload.subject)
-            where["subject"] = serializeJobSubject(query.payload.subject);
-        const rows = await selectMany(db, tenantJobFailuresTable, where, {
-            orderBy: { col: "failedAt", direction: "desc" },
-            limit: query.payload.limit ?? DEFAULT_LIMIT,
-        });
-        return {
-            rows: ctx.systemDb.assertRowsTenant(rows, "tenantId").map((row) => ({
-                jobName: row.jobName,
-                subject: parseSubject(row.subject),
-                messageKey: row.messageKey,
-                failedAt: row.failedAt,
-            })),
-            nextCursor: null,
-        };
-    },
-});
+            return {
+                rows: ctx.systemDb.assertRowsTenant(rows, "tenantId").map((row) => ({
+                    jobName: row.jobName,
+                    subject: parseSubject(row.subject),
+                    messageKey: row.messageKey,
+                    failedAt: row.failedAt,
+                })),
+                nextCursor: null,
+            };
+        },
+    });
+}

package/dist/jobs/handlers/tenant-runs.query.d.ts

@@ -1,6 +1,6 @@
 import * as z from "zod";
 import { type TenantJobRunStatus } from "../tenant-job-run-table.ts";
-export declare const tenantRunsQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"tenant-runs", z.ZodObject<{
+export declare function createTenantRunsQuery(readRoles: readonly string[]): import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"tenant-runs", z.ZodObject<{
     jobName: z.ZodOptional<z.ZodString>;
     subject: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
     limit: z.ZodOptional<z.ZodNumber>;

package/dist/jobs/handlers/tenant-runs.query.js

@@ -19,54 +19,58 @@ function parseSubject(stored) {
         return null;
     return Object.fromEntries(parsed.filter(isSubjectEntry));
 }
-export const tenantRunsQuery = defineQueryHandler({
-    name: "tenant-runs",
-    description: "Lists the calling tenant's own job runs that opted in via tenantVisibleRun — per job and subject every queued or running run plus the latest completed or failed one, active runs first, then newest first; each row carries only status and queuedAt/startedAt/finishedAt, never payloads, error text or logs; the optional subject filter matches exactly: all declared subjectFields with the same JSON types as the job payload; use it to show whether work for a subject is waiting, running or done, and to tell a failed run from a finished one.",
-    schema: z.object({
-        jobName: z.string().optional(),
-        subject: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).optional(),
-        limit: z.number().int().min(1).max(200).optional(),
-    }),
-    // Every membership rank: a run state carries a job name, a status and
-    // times, nothing a team member of the tenant may not see.
-    access: { roles: access.roles("User", "Editor", ...access.admin) },
-    handler: async (query, ctx) => {
-        if (!ctx.systemDb) {
-            throw new InternalError({
-                message: "jobs:query:tenant-runs requires ctx.systemDb (feature must declare r.systemScope())",
+export function createTenantRunsQuery(readRoles) {
+    return defineQueryHandler({
+        name: "tenant-runs",
+        description: "Lists the calling tenant's own job runs that opted in via tenantVisibleRun — per job and subject every queued or running run plus the latest completed or failed one, active runs first, then newest first; each row carries only status and queuedAt/startedAt/finishedAt, never payloads, error text or logs; the optional subject filter matches exactly: all declared subjectFields with the same JSON types as the job payload; use it to show whether work for a subject is waiting, running or done, and to tell a failed run from a finished one.",
+        schema: z.object({
+            jobName: z.string().optional(),
+            subject: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).optional(),
+            limit: z.number().int().min(1).max(200).optional(),
+        }),
+        // Every membership rank: a run state carries a job name, a status and
+        // times, nothing a team member of the tenant may not see.
+        access: {
+            roles: [...new Set([...access.roles("User", "Editor", ...access.admin), ...readRoles])],
+        },
+        handler: async (query, ctx) => {
+            if (!ctx.systemDb) {
+                throw new InternalError({
+                    message: "jobs:query:tenant-runs requires ctx.systemDb (feature must declare r.systemScope())",
+                });
+            }
+            // assertTenantMatch returns the same unfiltered system-mode db — the
+            // explicit tenantId below is the filter, assertRowsTenant the second net.
+            const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
+            const where = { tenantId: [query.user.tenantId] };
+            if (query.payload.jobName)
+                where["jobName"] = query.payload.jobName;
+            if (query.payload.subject)
+                where["subject"] = serializeJobSubject(query.payload.subject);
+            const limit = query.payload.limit ?? DEFAULT_LIMIT;
+            const newestFirst = { col: "updatedAt", direction: "desc" };
+            const activeRows = await selectMany(db, tenantJobRunsTable, { ...where, status: { in: ["queued", "running"] } }, { orderBy: newestFirst, limit });
+            const finishedRows = await selectMany(db, tenantJobRunsTable, { ...where, status: { in: ["completed", "failed"] } }, { orderBy: newestFirst, limit });
+            const seenFinishedKeys = new Set();
+            const finishedNewestPerKey = finishedRows.filter((row) => {
+                const key = JSON.stringify([row.jobName, row.subject]);
+                if (seenFinishedKeys.has(key))
+                    return false;
+                seenFinishedKeys.add(key);
+                return true;
             });
-        }
-        // assertTenantMatch returns the same unfiltered system-mode db — the
-        // explicit tenantId below is the filter, assertRowsTenant the second net.
-        const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
-        const where = { tenantId: [query.user.tenantId] };
-        if (query.payload.jobName)
-            where["jobName"] = query.payload.jobName;
-        if (query.payload.subject)
-            where["subject"] = serializeJobSubject(query.payload.subject);
-        const limit = query.payload.limit ?? DEFAULT_LIMIT;
-        const newestFirst = { col: "updatedAt", direction: "desc" };
-        const activeRows = await selectMany(db, tenantJobRunsTable, { ...where, status: { in: ["queued", "running"] } }, { orderBy: newestFirst, limit });
-        const finishedRows = await selectMany(db, tenantJobRunsTable, { ...where, status: { in: ["completed", "failed"] } }, { orderBy: newestFirst, limit });
-        const seenFinishedKeys = new Set();
-        const finishedNewestPerKey = finishedRows.filter((row) => {
-            const key = JSON.stringify([row.jobName, row.subject]);
-            if (seenFinishedKeys.has(key))
-                return false;
-            seenFinishedKeys.add(key);
-            return true;
-        });
-        const activeFirst = [...activeRows, ...finishedNewestPerKey];
-        return {
-            rows: ctx.systemDb.assertRowsTenant(activeFirst.slice(0, limit), "tenantId").map((row) => ({
-                jobName: row.jobName,
-                subject: parseSubject(row.subject),
-                status: row.status,
-                queuedAt: row.queuedAt,
-                startedAt: row.startedAt,
-                finishedAt: row.finishedAt,
-            })),
-            nextCursor: null,
-        };
-    },
-});
+            const activeFirst = [...activeRows, ...finishedNewestPerKey];
+            return {
+                rows: ctx.systemDb.assertRowsTenant(activeFirst.slice(0, limit), "tenantId").map((row) => ({
+                    jobName: row.jobName,
+                    subject: parseSubject(row.subject),
+                    status: row.status,
+                    queuedAt: row.queuedAt,
+                    startedAt: row.startedAt,
+                    finishedAt: row.finishedAt,
+                })),
+                nextCursor: null,
+            };
+        },
+    });
+}

package/dist/jobs/job-run-logger.js

@@ -157,15 +157,16 @@ async function recordTenantRunQueued(db, jobName, bullJobId, meta) {
     const now = Temporal.Now.instant();
     await transaction(db, async (tx) => {
         // A finished row under the same id is left over from before a Redis reset
-        // (ids restart at 1), not this job. Only rows that went through this hook
-        // (queuedAt set) qualify: a fast worker can finish before the hook runs,
-        // and that row is this job's own and must stay.
+        // (ids restart at 1), not this job. Only rows queued before this BullMQ job
+        // was created qualify: a fast worker can finish before the hook runs (no
+        // queuedAt), and a deduplicated add of an already finished job re-announces
+        // it with a creation time older than its own row. Both rows must stay.
         await deleteMany(tx, tenantJobRunsTable, {
             tenantId: key.tenantId,
             jobName,
             bullJobId,
             status: { in: ["completed", "failed"] },
-            queuedAt: { gt: Temporal.Instant.fromEpochMilliseconds(0) },
+            queuedAt: { lt: Temporal.Instant.fromEpochMilliseconds(meta.jobCreatedAtMs) },
         });
         // DO NOTHING: a fast worker can report the start before this enqueue hook
         // returns, and a repeated jobId (debounce, fan-out dedup) is the same job.

package/dist/mail-foundation/feature.d.ts

@@ -20,9 +20,9 @@ export declare const MAIL_TRANSPORT_EXTENSION: "mailTransport";
  *   config      — tenant config reads (the plugin's host/port/from/...)
  *   registry    — extension lookup in the factory (not plugin-internal)
  *   secrets     — tenant secret reads (smtp.password)
- *   auditUserId — audit identity for secret reads. Handler path: the
- *                 dispatcher sets the caller's user id; worker path: the
- *                 r.job wrap sets a system identity.
+ *   auditUserId — audit identity for secret reads. Handler path: unset,
+ *                 requireSecretsContext falls back to ctx.user.id; worker path:
+ *                 the r.job wrap sets a system identity.
  */
 export type MailTransportContext = {
     readonly config?: ConfigAccessor;

package/dist/mail-foundation/feature.js

@@ -147,6 +147,9 @@ export async function createTransportForTenantIfConfigured(ctx, tenantId, handle
 /** The `tenantTransport` resolver for `createChannelEmailFeature`: the tenant's configured
  *  provider, or null so the channel falls back to its app transport. */
 export function tenantMailTransport(scope) {
+    // Without a tenant config the provider cannot be read: use the app transport.
+    if (scope.config === undefined)
+        return Promise.resolve(null);
     return createTransportForTenantIfConfigured({
         config: scope.config,
         registry: scope.registry,

package/dist/personal-access-tokens/feature.d.ts

@@ -2,7 +2,7 @@ import { type FeatureDefinition, type ProjectionListScreenDefinition } from "@co
 import { type CreatePatOptions } from "./handlers/create.write.ts";
 import { type PatRateLimit } from "./web/constants.ts";
 import type { PatScopeConfig } from "./web/scopes.ts";
-export type BindPatAutoRevokeOnPasswordChange = (revoker: (userId: string) => Promise<number>) => void;
+export type BindPatAutoRevokeOnPasswordChange = (revoker: (userId: string) => Promise<number>) => () => void;
 export declare function bindPatAutoRevokeOnPasswordChangeFromFeature(feature: FeatureDefinition): BindPatAutoRevokeOnPasswordChange | undefined;
 export type PersonalAccessTokensOptions = {
     readonly scopes: PatScopeConfig;

package/dist/personal-access-tokens/feature.js

@@ -105,6 +105,10 @@ export function createPersonalAccessTokensFeature(options) {
         });
         const bindAutoRevokeOnPasswordChange = (revoker) => {
             boundAutoRevoke = revoker;
+            return () => {
+                if (boundAutoRevoke === revoker)
+                    boundAutoRevoke = undefined;
+            };
         };
         const handlers = {
             create: r.writeHandler(createPatCreateHandler({ mfaVerifier: options.mfaVerifier })),

package/dist/renderer-pdf/render-table-pdf.d.ts

@@ -44,5 +44,5 @@ export type PdfTableResult = {
     readonly pdfBytes: Uint8Array;
     readonly pageCount: number;
 };
-export declare function renderTablePdf(doc: PdfTableDocument, options?: PdfTableOptions): Promise<PdfTableResult>;
+export declare function renderTablePdf(untrustedDoc: PdfTableDocument, options?: PdfTableOptions): Promise<PdfTableResult>;
 export {};

package/dist/renderer-pdf/render-table-pdf.js

@@ -5,19 +5,28 @@ import { RendererError } from "../renderer-foundation/index.js";
 const PDF_TABLE_MAX_ROWS = 10_000;
 const PDF_TABLE_MAX_COLUMNS = 30;
 const PDF_TABLE_MAX_CELL_LENGTH = 5_000;
+const PDF_TABLE_MAX_META_ENTRIES = 500;
+const PDF_TABLE_MAX_TEXT_LENGTH = 20_000;
+const PDF_TABLE_MAX_PAGE_LABEL_LENGTH = 100;
 const pdfTableColumnSchema = z
     .object({
-    header: z.string(),
+    header: z.string().max(PDF_TABLE_MAX_TEXT_LENGTH),
     weight: z.number().positive().optional(),
     align: z.enum(["left", "right"]).optional(),
 })
     .readonly();
 export const pdfTableDocumentSchema = z
     .object({
-    title: z.string(),
-    subtitle: z.string().optional(),
+    title: z.string().max(PDF_TABLE_MAX_TEXT_LENGTH),
+    subtitle: z.string().max(PDF_TABLE_MAX_TEXT_LENGTH).optional(),
     meta: z
-        .array(z.object({ label: z.string(), value: z.string() }).readonly())
+        .array(z
+        .object({
+        label: z.string().max(PDF_TABLE_MAX_TEXT_LENGTH),
+        value: z.string().max(PDF_TABLE_MAX_TEXT_LENGTH),
+    })
+        .readonly())
+        .max(PDF_TABLE_MAX_META_ENTRIES)
         .readonly()
         .optional(),
     columns: z.array(pdfTableColumnSchema).min(1).max(PDF_TABLE_MAX_COLUMNS).readonly(),
@@ -25,10 +34,10 @@ export const pdfTableDocumentSchema = z
         .array(z.array(z.string().max(PDF_TABLE_MAX_CELL_LENGTH)).readonly())
         .max(PDF_TABLE_MAX_ROWS)
         .readonly(),
-    emptyText: z.string().optional(),
-    footerText: z.string().optional(),
+    emptyText: z.string().max(PDF_TABLE_MAX_TEXT_LENGTH).optional(),
+    footerText: z.string().max(PDF_TABLE_MAX_TEXT_LENGTH).optional(),
     // Template with `{page}` and `{pages}`; default `"{page} / {pages}"`.
-    pageLabel: z.string().optional(),
+    pageLabel: z.string().max(PDF_TABLE_MAX_PAGE_LABEL_LENGTH).optional(),
 })
     .readonly();
 const marginMmSchema = z
@@ -174,10 +183,13 @@ function resolveTableLayout(doc, options, fonts, clean) {
         headerHeight,
     };
 }
-export async function renderTablePdf(doc, options) {
-    if (doc.columns.length === 0) {
-        throw new RendererError("table needs at least one column", "invalid_payload");
+export async function renderTablePdf(untrustedDoc, options) {
+    // Direct callers bypass renderTablePdfRequest, so the size caps are enforced here too.
+    const parsed = pdfTableDocumentSchema.safeParse(untrustedDoc);
+    if (!parsed.success) {
+        throw new RendererError(`table document is invalid: ${parsed.error.message}`, "invalid_payload");
     }
+    const doc = parsed.data;
     assertRowShape(doc);
     const pdf = await PDFDocument.create({ updateMetadata: false });
     const fonts = {

package/dist/sessions/feature.d.ts

@@ -5,7 +5,7 @@ export type SessionsFeatureOptions = {
     readonly expiresInMs?: number;
     readonly adminAccess?: "admin" | "systemAdmin";
 };
-export type BindAutoRevokeOnPasswordChange = (revoker: SessionMassRevoker) => void;
-export type BindRevokeAllOtherSessions = (revoker: SessionAllOthersRevoker) => void;
+export type BindAutoRevokeOnPasswordChange = (revoker: SessionMassRevoker) => () => void;
+export type BindRevokeAllOtherSessions = (revoker: SessionAllOthersRevoker) => () => void;
 export declare function bindAutoRevokeFromFeature(feature: FeatureDefinition): BindAutoRevokeOnPasswordChange | undefined;
 export declare function createSessionsFeature(options?: SessionsFeatureOptions): FeatureDefinition;

package/dist/sessions/feature.js

@@ -170,6 +170,10 @@ export function createSessionsFeature(options) {
         });
         const bindAutoRevokeOnPasswordChange = (revoker) => {
             boundAutoRevoke = revoker;
+            return () => {
+                if (boundAutoRevoke === revoker)
+                    boundAutoRevoke = undefined;
+            };
         };
         r.translations({ keys: SESSIONS_I18N });
         r.screen(createSessionListScreen(adminRoles));

package/dist/shared/decrypt-stored-pii.d.ts

@@ -1 +1,2 @@
 export declare function decryptStoredPii(value: string, field: string, fallbackRequestId: string): Promise<string>;
+export declare function decryptStoredUserEmail(stored: string, fallbackRequestId: string): Promise<string | null>;

package/dist/shared/decrypt-stored-pii.js

@@ -1,5 +1,5 @@
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
-import { configuredPiiSubjectKms, decryptPiiFieldValues, } from "@cosmicdrift/kumiko-framework/crypto";
+import { configuredPiiSubjectKms, decryptPiiFieldValues, PII_ERASED_SENTINEL, } from "@cosmicdrift/kumiko-framework/crypto";
 // Raw reads (fetchOne/selectMany) return the stored column value — with an
 // active KMS that is ciphertext (self-describing: it names its own subject,
 // so no entity/field context is needed for key selection). `field` must
@@ -17,3 +17,8 @@ export async function decryptStoredPii(value, field, fallbackRequestId) {
     const decrypted = out[field];
     return typeof decrypted === "string" ? decrypted : value;
 }
+// Null for an erased subject: the sentinel must never be mailed or shown as an address.
+export async function decryptStoredUserEmail(stored, fallbackRequestId) {
+    const email = await decryptStoredPii(stored, "email", fallbackRequestId);
+    return email === PII_ERASED_SENTINEL ? null : email;
+}

package/dist/shared/index.d.ts

@@ -3,7 +3,7 @@ export { assertNoWhereRuleInOwnershipWrite } from "./assert-no-where-rule-in-own
 export { attachmentFileNameSchema, sanitizePdfAttachmentFileName, } from "./attachment-file-name.ts";
 export { type ChunkedMigrationOptions, type ChunkedMigrationResult, type ChunkedMigrationStopReason, type MigrationRowOutcome, runChunkedMigration, } from "./chunked-entity-migration.ts";
 export { classifyStoredEnvelope, type StoredEnvelopeClassification, } from "./classify-stored-envelope.ts";
-export { decryptStoredPii } from "./decrypt-stored-pii.ts";
+export { decryptStoredPii, decryptStoredUserEmail } from "./decrypt-stored-pii.ts";
 export { encryptForDirectWrite } from "./encrypt-for-direct-write.ts";
 export { entitiesOf } from "./entities-of.ts";
 export { isWithinGracePeriod } from "./grace-period.ts";

package/dist/shared/index.js

@@ -3,7 +3,7 @@ export { assertNoWhereRuleInOwnershipWrite } from "./assert-no-where-rule-in-own
 export { attachmentFileNameSchema, sanitizePdfAttachmentFileName, } from "./attachment-file-name.js";
 export { runChunkedMigration, } from "./chunked-entity-migration.js";
 export { classifyStoredEnvelope, } from "./classify-stored-envelope.js";
-export { decryptStoredPii } from "./decrypt-stored-pii.js";
+export { decryptStoredPii, decryptStoredUserEmail } from "./decrypt-stored-pii.js";
 export { encryptForDirectWrite } from "./encrypt-for-direct-write.js";
 export { entitiesOf } from "./entities-of.js";
 export { isWithinGracePeriod } from "./grace-period.js";

package/dist/shared/mail-template-body.d.ts

@@ -1,7 +1,11 @@
 export declare function mailTextWithSlotsHtml(text: string): string;
-export declare function mailParagraph(text: string): string;
+type MailParagraphOptions = {
+    readonly showIf?: string;
+};
+export declare function mailParagraph(text: string, options?: MailParagraphOptions): string;
 export declare function mailHeading(text: string): string;
 export declare function mailButton(label: string, linkVariable: string): string;
-export declare function mailParagraphWithLink(text: string, linkLabel: string, linkVariable: string): string;
+export declare function mailParagraphWithLink(text: string, linkLabel: string, linkVariable: string, options?: MailParagraphOptions): string;
 export declare function mailRepeatedRows(listName: string, field: string): string;
 export declare function mailSubject(text: string): string;
+export {};

package/dist/shared/mail-template-body.js

@@ -5,8 +5,11 @@ const SLOT_PATTERN = /\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 export function mailTextWithSlotsHtml(text) {
     return escapeHtml(text).replace(SLOT_PATTERN, (_, name) => `<span data-variable="${escapeHtmlAttr(name)}"></span>`);
 }
-export function mailParagraph(text) {
-    return `<p>${mailTextWithSlotsHtml(text)}</p>`;
+function paragraphOpenTag(options) {
+    return options?.showIf === undefined ? "<p>" : `<p data-if="${escapeHtmlAttr(options.showIf)}">`;
+}
+export function mailParagraph(text, options) {
+    return `${paragraphOpenTag(options)}${mailTextWithSlotsHtml(text)}</p>`;
 }
 export function mailHeading(text) {
     return `<h2>${mailTextWithSlotsHtml(text)}</h2>`;
@@ -14,8 +17,8 @@ export function mailHeading(text) {
 export function mailButton(label, linkVariable) {
     return `<p><a data-button href="{{${escapeHtmlAttr(linkVariable)}}}">${escapeHtml(label)}</a></p>`;
 }
-export function mailParagraphWithLink(text, linkLabel, linkVariable) {
-    return `<p>${mailTextWithSlotsHtml(text)} <a href="{{${escapeHtmlAttr(linkVariable)}}}">${escapeHtml(linkLabel)}</a></p>`;
+export function mailParagraphWithLink(text, linkLabel, linkVariable, options) {
+    return `${paragraphOpenTag(options)}${mailTextWithSlotsHtml(text)} <a href="{{${escapeHtmlAttr(linkVariable)}}}">${escapeHtml(linkLabel)}</a></p>`;
 }
 // One table row per list entry; the cell shows the entry's `field`.
 export function mailRepeatedRows(listName, field) {

package/dist/step-dispatcher/feature.js

@@ -42,6 +42,7 @@ export function createStepDispatcherFeature() {
             retries: DELIVER_RETRIES,
             backoff: "exponential",
             maxPerTenant: { limit: DELIVER_MAX_PER_TENANT, onLimit: "defer" },
+            schema: deliverJobPayloadSchema,
             escapeHatch: { reason: DELIVER_ESCAPE_HATCH_REASON },
         }, async (payload, ctx) => {
             const { aggregateId } = deliverJobPayloadSchema.parse(payload);

package/dist/subscription-dodo/client.d.ts

@@ -0,0 +1,17 @@
+export type DodoSend = (url: string, init?: RequestInit) => Promise<Response>;
+export type DodoRequest = {
+    readonly method: "GET" | "POST" | "PATCH";
+    /** Path segments interpolated into it must already be encodeURIComponent'ed. */
+    readonly path: string;
+    readonly query?: Readonly<Record<string, string>>;
+    readonly body?: unknown;
+};
+export type DodoTarget = {
+    readonly baseUrl: string;
+    readonly apiKey: string;
+};
+export declare class DodoHttpError extends Error {
+    readonly status: number;
+    constructor(request: DodoRequest, status: number);
+}
+export declare function createDodoHttp(send: DodoSend): (target: DodoTarget, request: DodoRequest) => Promise<unknown>;