@cosmicdrift/kumiko-bundled-features 0.387.0 → 0.389.0

package/dist/delivery/system-channel-context.d.ts

@@ -0,0 +1,15 @@
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { ConfigAccessor, Registry } from "@cosmicdrift/kumiko-framework/engine";
+import type { FileContext } from "@cosmicdrift/kumiko-framework/files";
+import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
+import type { ChannelContext } from "./types.ts";
+export type SystemChannelContextDeps = {
+    readonly db: DbConnection;
+    readonly registry: Registry;
+    readonly filesForTenant: (tenantId: string) => FileContext | undefined;
+};
+export type SystemChannelContextOptions = {
+    readonly config?: ConfigAccessor;
+    readonly secrets?: SecretsContext;
+};
+export declare function buildSystemChannelContext(deps: SystemChannelContextDeps, options?: SystemChannelContextOptions): ChannelContext;

package/dist/delivery/system-channel-context.js

@@ -0,0 +1,5 @@
+import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { buildChannelContext } from "./channel-context.js";
+export function buildSystemChannelContext(deps, options = {}) {
+    return buildChannelContext(deps.db, deps.registry, undefined, SYSTEM_TENANT_ID, options.secrets, options.config, deps.filesForTenant);
+}

package/dist/delivery/unsubscribe-link.d.ts

@@ -5,7 +5,9 @@ export type UnsubscribeLinkConfig = {
     readonly secret: string;
     readonly baseUrl: string;
     /** The sending tenant's own public origin (subdomain or custom domain), null when it has
-     *  none. The host must serve this app's `/api` routes. Null, a throw or an unusable value
+     *  none. The host must serve this app's `/api` routes, and the callback must only return a
+     *  verified, active domain of the tenant (the check that lets the app serve under it), else null:
+     *  the link carries a bearer token that unsubscribes and yields a resubscribe token. Null, a throw or an unusable value
      *  fall back to `baseUrl`, so a missing tenant origin never fails a send. */
     readonly tenantOrigin?: (ctx: ChannelContext) => Promise<string | null | undefined>;
 };

package/dist/delivery/unsubscribe-page-strings.d.ts

@@ -10,6 +10,7 @@ export declare const UNSUBSCRIBE_PAGE_EN: {
     readonly "mail.unsubscribe.resubscribedMessage": "You have been subscribed again.";
     readonly "mail.unsubscribe.failed": "That did not work. Please try again later.";
     readonly "mail.unsubscribe.failedTitle": "Something went wrong";
+    readonly "mail.unsubscribe.resubscribeLimitReached": "This address cannot be subscribed again here.";
     readonly "mail.unsubscribe.invalidTitle": "Link no longer valid";
     readonly "mail.unsubscribe.invalidMessage": "This link is invalid or has expired. Please use the unsubscribe link in a more recent email.";
 };

package/dist/delivery/unsubscribe-page-strings.js

@@ -13,6 +13,7 @@ export const UNSUBSCRIBE_PAGE_EN = {
     "mail.unsubscribe.resubscribedMessage": "You have been subscribed again.",
     "mail.unsubscribe.failed": "That did not work. Please try again later.",
     "mail.unsubscribe.failedTitle": "Something went wrong",
+    "mail.unsubscribe.resubscribeLimitReached": "This address cannot be subscribed again here.",
     "mail.unsubscribe.invalidTitle": "Link no longer valid",
     "mail.unsubscribe.invalidMessage": "This link is invalid or has expired. Please use the unsubscribe link in a more recent email.",
 };

package/dist/delivery/unsubscribe-page.d.ts

@@ -10,6 +10,8 @@ export type UnsubscribePageState = {
     readonly kind: "resubscribed";
 } | {
     readonly kind: "failed";
+} | {
+    readonly kind: "resubscribeLimitReached";
 } | {
     readonly kind: "invalid";
 };

package/dist/delivery/unsubscribe-page.js

@@ -135,6 +135,11 @@ ${tokenForm(DELIVERY_RESUBSCRIBE_PATH, state.resubscribeToken, mailT(lang, "mail
                 title: mailT(lang, "mail.unsubscribe.failedTitle"),
                 bodyHtml: paragraph("mail.unsubscribe.failed"),
             };
+        case "resubscribeLimitReached":
+            return {
+                title: mailT(lang, "mail.unsubscribe.failedTitle"),
+                bodyHtml: paragraph("mail.unsubscribe.resubscribeLimitReached"),
+            };
         case "invalid":
             return {
                 title: mailT(lang, "mail.unsubscribe.invalidTitle"),

package/dist/delivery/unsubscribe.js

@@ -373,10 +373,16 @@ async function verifyForPage(token, encodedSecret, purpose, headers) {
     }
 }
 async function verifyPost(request, token, encodedSecret, purpose) {
-    return isFormRequest(request.headers["content-type"])
+    return isFormRequest(request.headers["content-type"]) && !isOneClickPost(request)
         ? verifyForPage(token, encodedSecret, purpose, request.headers)
         : verifyUnsubscribeToken(token, encodedSecret, purpose);
 }
+// RFC 8058 mail-provider POSTs are form-encoded too, but nobody looks at the answer: they keep
+// the JSON rejection and get no branded page.
+function isOneClickPost(request) {
+    return (isFormRequest(request.headers["content-type"]) &&
+        request.rawBody.trim() === DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE);
+}
 function isFormRequest(contentType) {
     return contentType?.includes("application/x-www-form-urlencoded") === true;
 }
@@ -435,22 +441,31 @@ export function createUnsubscribeRoutes(options) {
         method: "POST",
         path: DELIVERY_UNSUBSCRIBE_PATH,
         entry: "signature",
-        verify: async (request) => verifyPost(request, tokenFromPostRequest(request), encodedSecret, "unsubscribe"),
+        verify: async (request) => {
+            const verified = await verifyPost(request, tokenFromPostRequest(request), encodedSecret, "unsubscribe");
+            return verified.kind === "rejected"
+                ? verified
+                : { ...verified, oneClick: isOneClickPost(request) };
+        },
         handler: async (c, verified, deps) => {
             if (verified.kind === "rejected") {
                 return pageResponse(c, deps, { kind: "invalid" }, verified, 400);
             }
+            // No chrome lookup for a one-click client: it never renders the page.
+            const pageScope = verified.oneClick
+                ? { tenantId: undefined, locale: verified.locale }
+                : verified;
             // Token-verify passed — everything below is a legitimate write. Don't
             // swallow write-errors as "invalid token", that would mask real bugs
             // (e.g. events-table missing, DB down) behind a misleading 400.
             const succeeded = await dispatchUnsubscribeWrite(verified, deps);
             if (!succeeded) {
-                return pageResponse(c, deps, { kind: "failed" }, verified, 500);
+                return pageResponse(c, deps, { kind: "failed" }, pageScope, 500);
             }
             return pageResponse(c, deps, {
                 kind: "unsubscribed",
                 resubscribeToken: await signResubscribeToken(verified, encodedSecret),
-            }, verified, 200);
+            }, pageScope, 200);
         },
     });
     // Undo direction: token only from the JSON/form body, never the query
@@ -468,9 +483,12 @@ export function createUnsubscribeRoutes(options) {
             const outcome = await dispatchResubscribeWrite(verified, deps);
             // The undo button on the unsubscribed page posts a form; a browser should land on a page.
             if (isFormRequest(c.req.header("content-type"))) {
-                return outcome === "success"
-                    ? pageResponse(c, deps, { kind: "resubscribed" }, verified, 200)
-                    : pageResponse(c, deps, { kind: "failed" }, verified, outcome === "limit_reached" ? 409 : 500);
+                if (outcome === "success") {
+                    return pageResponse(c, deps, { kind: "resubscribed" }, verified, 200);
+                }
+                return outcome === "limit_reached"
+                    ? pageResponse(c, deps, { kind: "resubscribeLimitReached" }, verified, 409)
+                    : pageResponse(c, deps, { kind: "failed" }, verified, 500);
             }
             if (outcome === "limit_reached") {
                 return c.json({ error: { code: DeliveryErrors.resubscribeLimitReached } }, 409, NO_STORE_HEADERS);

package/dist/document-ingest-foundation/append-missing-extract-event.d.ts

@@ -0,0 +1,21 @@
+import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import type { Registry, SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+export type ExistingDocumentExtract = {
+    readonly id: string;
+    readonly meta: {
+        readonly error?: unknown;
+    } | null;
+};
+export type AppendMissingExtractEventDeps = {
+    readonly tenantDb: TenantDb;
+    readonly registry: Registry;
+    readonly actor: SessionUser;
+    readonly tenantId: string;
+};
+export type AppendMissingExtractEventOptions = {
+    readonly readyEventQn: string;
+    readonly failedEventQn: string;
+    readonly mapError?: (error: string) => string;
+};
+export type AppendMissingExtractEventResult = "appended-ready" | "appended-failed" | "already-terminal";
+export declare function appendMissingDocumentExtractEvent(deps: AppendMissingExtractEventDeps, existing: ExistingDocumentExtract, fileRefId: string, options: AppendMissingExtractEventOptions): Promise<AppendMissingExtractEventResult>;

package/dist/document-ingest-foundation/append-missing-extract-event.js

@@ -0,0 +1,42 @@
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import { appendEventInTenantDb, getStreamVersionInTenantDb, } from "@cosmicdrift/kumiko-framework/event-store";
+import { DOCUMENT_EXTRACT_AGGREGATE_TYPE, documentExtractFailedPayloadSchema, documentExtractReadyPayloadSchema, } from "./events.js";
+// Version 1 of the stream is the extract's created event; anything beyond it is the terminal event.
+const CREATED_ONLY_STREAM_VERSION = 1;
+const UNKNOWN_EXTRACT_ERROR = "unknown extract error";
+// A previous delivery created the extract but died before appending its ready/failed event.
+// Without the event, consumers waiting on it hang forever.
+export async function appendMissingDocumentExtractEvent(deps, existing, fileRefId, options) {
+    if (deps.tenantDb.tenantId !== deps.tenantId) {
+        throw new InternalError({
+            message: `document-ingest-foundation: tenantDb is bound to tenant ${deps.tenantDb.tenantId}, not ${deps.tenantId}`,
+        });
+    }
+    const version = await getStreamVersionInTenantDb(deps.tenantDb, existing.id);
+    // A missing stream means a wrong id; appending would make the terminal event the first event of a new stream.
+    if (version === 0) {
+        throw new InternalError({
+            message: `document-ingest-foundation: no document extract stream for id ${existing.id}`,
+        });
+    }
+    // skip: the terminal event was already written, nothing to catch up
+    if (version > CREATED_ONLY_STREAM_VERSION)
+        return "already-terminal";
+    const metaError = existing.meta?.error;
+    const failed = typeof metaError === "string";
+    await appendEventInTenantDb(deps.tenantDb, {
+        aggregateId: existing.id,
+        aggregateType: DOCUMENT_EXTRACT_AGGREGATE_TYPE,
+        expectedVersion: version,
+        type: failed ? options.failedEventQn : options.readyEventQn,
+        payload: failed
+            ? documentExtractFailedPayloadSchema.parse({
+                documentExtractId: existing.id,
+                fileRefId,
+                error: options.mapError?.(metaError) || metaError || UNKNOWN_EXTRACT_ERROR,
+            })
+            : documentExtractReadyPayloadSchema.parse({ documentExtractId: existing.id, fileRefId }),
+        metadata: { userId: deps.actor.id },
+    }, { registry: deps.registry });
+    return failed ? "appended-failed" : "appended-ready";
+}

package/dist/document-ingest-foundation/events.d.ts

@@ -26,3 +26,14 @@ export declare const documentIngestSkippedPayloadSchema: z.ZodObject<{
     }>;
 }, z.core.$strip>;
 export type DocumentIngestSkippedPayload = z.infer<typeof documentIngestSkippedPayloadSchema>;
+export declare const documentExtractReadyPayloadSchema: z.ZodObject<{
+    documentExtractId: z.ZodString;
+    fileRefId: z.ZodString;
+}, z.core.$strip>;
+export type DocumentExtractReadyPayload = z.infer<typeof documentExtractReadyPayloadSchema>;
+export declare const documentExtractFailedPayloadSchema: z.ZodObject<{
+    documentExtractId: z.ZodString;
+    fileRefId: z.ZodString;
+    error: z.ZodString;
+}, z.core.$strip>;
+export type DocumentExtractFailedPayload = z.infer<typeof documentExtractFailedPayloadSchema>;

package/dist/document-ingest-foundation/events.js

@@ -35,3 +35,14 @@ export const documentIngestSkippedPayloadSchema = z.object({
     size: z.number().int().min(0),
     reason: z.enum(["file-too-large", "unsupported-mime-type"]),
 });
+// Terminal events of a document-extract stream. The QNs belong to the provider that registers
+// them; the foundation only owns the shared payload shape.
+export const documentExtractReadyPayloadSchema = z.object({
+    documentExtractId: z.string().min(1),
+    fileRefId: z.string().min(1),
+});
+export const documentExtractFailedPayloadSchema = z.object({
+    documentExtractId: z.string().min(1),
+    fileRefId: z.string().min(1),
+    error: z.string().min(1),
+});

package/dist/document-ingest-foundation/index.d.ts

@@ -1,6 +1,7 @@
 export { documentIngestAggregateId } from "./aggregate-id.ts";
+export { type AppendMissingExtractEventDeps, type AppendMissingExtractEventOptions, type AppendMissingExtractEventResult, appendMissingDocumentExtractEvent, type ExistingDocumentExtract, } from "./append-missing-extract-event.ts";
 export { type DocumentExtractMeta, documentExtractEntity, documentExtractsTable, type IngestPage, } from "./entity.ts";
-export { DOCUMENT_EXTRACT_AGGREGATE_TYPE, DOCUMENT_INGEST_AGGREGATE_TYPE, DOCUMENT_INGEST_REQUESTED_EVENT_QN, DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, DOCUMENT_INGEST_SKIPPED_EVENT_QN, DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, type DocumentIngestRequestedPayload, type DocumentIngestSkippedPayload, documentIngestRequestedPayloadSchema, documentIngestSkippedPayloadSchema, } from "./events.ts";
+export { DOCUMENT_EXTRACT_AGGREGATE_TYPE, DOCUMENT_INGEST_AGGREGATE_TYPE, DOCUMENT_INGEST_REQUESTED_EVENT_QN, DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, DOCUMENT_INGEST_SKIPPED_EVENT_QN, DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, type DocumentExtractFailedPayload, type DocumentExtractReadyPayload, type DocumentIngestRequestedPayload, type DocumentIngestSkippedPayload, documentExtractFailedPayloadSchema, documentExtractReadyPayloadSchema, documentIngestRequestedPayloadSchema, documentIngestSkippedPayloadSchema, } from "./events.ts";
 export { createDocumentIngestFoundationFeature } from "./feature.ts";
 export { readIngestPages, writeIngestPages } from "./pages.ts";
 export { type DocumentIngestProviderOptions, documentIngestProviderOptionsSchema, documentIngestProviderTrigger, EXT_DOCUMENT_INGEST_PROVIDER, listIngestibleMimeTypes, type ResolvedDocumentIngestProvider, resolveDocumentIngestProviders, } from "./providers.ts";

package/dist/document-ingest-foundation/index.js

@@ -1,7 +1,8 @@
 // Public API of the document-ingest-foundation bundled-feature.
 export { documentIngestAggregateId } from "./aggregate-id.js";
+export { appendMissingDocumentExtractEvent, } from "./append-missing-extract-event.js";
 export { documentExtractEntity, documentExtractsTable, } from "./entity.js";
-export { DOCUMENT_EXTRACT_AGGREGATE_TYPE, DOCUMENT_INGEST_AGGREGATE_TYPE, DOCUMENT_INGEST_REQUESTED_EVENT_QN, DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, DOCUMENT_INGEST_SKIPPED_EVENT_QN, DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, documentIngestRequestedPayloadSchema, documentIngestSkippedPayloadSchema, } from "./events.js";
+export { DOCUMENT_EXTRACT_AGGREGATE_TYPE, DOCUMENT_INGEST_AGGREGATE_TYPE, DOCUMENT_INGEST_REQUESTED_EVENT_QN, DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, DOCUMENT_INGEST_SKIPPED_EVENT_QN, DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, documentExtractFailedPayloadSchema, documentExtractReadyPayloadSchema, documentIngestRequestedPayloadSchema, documentIngestSkippedPayloadSchema, } from "./events.js";
 export { createDocumentIngestFoundationFeature } from "./feature.js";
 export { readIngestPages, writeIngestPages } from "./pages.js";
 export { documentIngestProviderOptionsSchema, documentIngestProviderTrigger, EXT_DOCUMENT_INGEST_PROVIDER, listIngestibleMimeTypes, resolveDocumentIngestProviders, } from "./providers.js";

package/dist/feature-toggles/feature.js

@@ -8,6 +8,7 @@ import { FEATURE_TOGGLES_I18N } from "./i18n.js";
 import { FEATURE_TOGGLE_SET_EVENT_NAME, FeatureToggleHandlers, FeatureToggleQueries, TOGGLE_ADMIN_SCREEN_ID, } from "./web/constants.js";
 export function createFeatureTogglesFeature(options = {}) {
     return defineFeature("feature-toggles", (r) => {
+        r.adoptsBundledLists();
         r.describe('Persists per-feature enabled/disabled state in the `store_global_feature_state` table and exposes a `set` write-handler plus `list`/`registered` query-handlers so operators can flip features at runtime without redeploying. Each API instance keeps an in-memory `GlobalFeatureToggleRuntime` snapshot (initialize it via `createFeatureToggleRuntime`, pass a `() => runtime` accessor to `createFeatureTogglesFeature`) that the dispatcher gate reads on every request; a `toggle-cache-sync` multi-stream projection with `delivery: "shared"` syncs the snapshot across instances whenever a `toggle-set` event is appended.');
         r.uiHints({
             displayLabel: "Feature Toggles · Operator Switches",

package/dist/file-foundation/index.d.ts

@@ -1,2 +1,2 @@
 export { createFileFoundationFeature, createFileProviderForTenant, type FileProviderContext, type FileProviderPlugin, isFileProviderPlugin, } from "./feature.ts";
-export { type FileRefContent, FileRefTooLargeError, fileContextForTenant, fileContextFromResolver, readFileRefContent, } from "./read-file-ref-content.ts";
+export { type FileRefContent, FileRefTooLargeError, FileStorageUnavailableError, fileContextForTenant, fileContextFromResolver, readFileRefContent, } from "./read-file-ref-content.ts";

package/dist/file-foundation/index.js

@@ -1,3 +1,3 @@
 // Public API of the file-foundation bundled-feature.
 export { createFileFoundationFeature, createFileProviderForTenant, isFileProviderPlugin, } from "./feature.js";
-export { FileRefTooLargeError, fileContextForTenant, fileContextFromResolver, readFileRefContent, } from "./read-file-ref-content.js";
+export { FileRefTooLargeError, FileStorageUnavailableError, fileContextForTenant, fileContextFromResolver, readFileRefContent, } from "./read-file-ref-content.js";

package/dist/file-foundation/read-file-ref-content.d.ts

@@ -15,6 +15,9 @@ export declare class FileRefTooLargeError extends Error {
     readonly size: number;
     constructor(size: number);
 }
+export declare class FileStorageUnavailableError extends Error {
+    constructor();
+}
 export declare function readFileRefContent(args: {
     readonly db: DbRunner | TenantDb;
     readonly filesForTenant: (tenantId: string) => FileContext | undefined;

package/dist/file-foundation/read-file-ref-content.js

@@ -22,6 +22,11 @@ export class FileRefTooLargeError extends Error {
         this.size = size;
     }
 }
+export class FileStorageUnavailableError extends Error {
+    constructor() {
+        super("readFileRefContent: no file storage is available for the file's tenant");
+    }
+}
 // fileName of the row is never used: it is personal data and may be a PII ciphertext.
 export async function readFileRefContent(args) {
     if (!isUuid(args.fileRefId))
@@ -44,7 +49,7 @@ export async function readFileRefContent(args) {
     }
     const files = args.filesForTenant(row.tenantId);
     if (files === undefined) {
-        throw new Error("readFileRefContent: no file storage is available for the file's tenant");
+        throw new FileStorageUnavailableError();
     }
     const content = await files.refFromFileRef(row).read();
     return { content, contentType: row.mimeType, tenantId: row.tenantId, size };

package/dist/file-provider-s3/env-named-feature.d.ts

@@ -3,8 +3,6 @@ export type NamedS3EnvProviderOptions = {
     readonly name: string;
     /** Env prefix of the credential set, e.g. `RELEASES_S3_`. */
     readonly envPrefix: string;
-    /** Tolerate missing credentials at boot; the provider then fails on its first file operation. */
-    readonly lazy?: boolean;
 };
 /** An additional S3 provider next to `"s3-env"`, reading its credentials from `<envPrefix>BUCKET` etc. */
 export declare function createFileProviderS3NamedEnvFeature(options: NamedS3EnvProviderOptions): import("@cosmicdrift/kumiko-framework/env").FeatureWithEnvSchema<import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {

package/dist/form-draft/db/queries/cleanup.js

@@ -1,4 +1,4 @@
-import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/db";
+import { toPostgresArrayLiteral, unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/db";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { readStoredDraft } from "../../decrypt-draft.js";
 // COALESCE(modified_at, inserted_at) — a draft's "last touched" timestamp is
@@ -17,7 +17,7 @@ export async function selectStaleDraftsBatch(db, olderThanDays, batchSize, exclu
      WHERE COALESCE("modified_at", "inserted_at") < now() - ($1::int * interval '1 day')
      AND NOT ("id"::text = ANY($3::text[]))
      ORDER BY COALESCE("modified_at", "inserted_at") ASC
-     LIMIT $2`, [olderThanDays, batchSize, [...excludeIds]]);
+     LIMIT $2`, [olderThanDays, batchSize, toPostgresArrayLiteral([...excludeIds])]);
     return Promise.all(rows.map(async (row) => {
         const base = {
             id: row.id,

package/dist/form-draft/decrypt-draft.js

@@ -1,5 +1,6 @@
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, } from "@cosmicdrift/kumiko-framework/crypto";
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { formDraftBlobSchema } from "./schemas.js";
 // Raw reads (fetchOne/selectMany/SQL) return the stored column, which is
 // ciphertext once the owner's key exists. The field name is part of the AAD,
@@ -8,7 +9,10 @@ import { formDraftBlobSchema } from "./schemas.js";
 export async function readStoredDraft(stored) {
     let plain = stored;
     const kms = configuredPiiSubjectKms();
-    if (isPiiCiphertext(stored) && kms) {
+    if (isPiiCiphertext(stored)) {
+        // A silent null would make the stale-draft cleanup treat the draft as empty and leak its file refs.
+        if (!kms)
+            throw new InternalError({ message: "form-draft: pii kms not configured" });
         const out = await decryptPiiFieldValues({ draft: stored }, ["draft"], kms, {
             requestId: requestContext.get()?.requestId ?? "form-draft:read",
         });

package/dist/host-routing/dispatch.js

@@ -6,38 +6,29 @@ import { classifyHost, splitFirstSegment, tenantKeyFromPath } from "./host.js";
 import { matchRedirect, sameOriginPath } from "./redirects.js";
 import { validateHostRoutingOptions } from "./validate-options.js";
 const tenantKeyExistsResultSchema = z.object({ exists: z.boolean() });
-async function isTenantKeyKnown(systemQuery, key) {
+async function existsViaSystemQuery(systemQuery, queryType, payload) {
     let result;
     try {
-        result = await systemQuery(HostRoutingQueries.tenantKeyExists, { key }, SYSTEM_TENANT_ID);
+        result = await systemQuery(queryType, payload, SYSTEM_TENANT_ID);
     }
     catch (error) {
         if (error instanceof ValidationError)
             return false;
-        // Over the rate limit every key looks the same: serve the tenant shell,
-        // which leaks nothing; the API behind it still resolves the tenant itself.
+        // Over the rate limit every key looks the same: serve the shell, which
+        // leaks nothing. The API resolver is authoritative and answers
+        // tenant_required for unknown hosts, while a 404 would hit visitors
+        // behind a shared NAT under load.
         if (error instanceof RateLimitError)
             return true;
         throw error;
     }
     return tenantKeyExistsResultSchema.parse(result).exists;
 }
-async function isHostKnown(systemQuery, host) {
-    let result;
-    try {
-        result = await systemQuery(HostRoutingQueries.hostTenantExists, { host }, SYSTEM_TENANT_ID);
-    }
-    catch (error) {
-        if (error instanceof ValidationError)
-            return false;
-        // The shell is harmless: the API resolver is authoritative and answers
-        // tenant_required for unknown hosts, while a 404 would hit visitors behind
-        // a shared NAT under load.
-        if (error instanceof RateLimitError)
-            return true;
-        throw error;
-    }
-    return tenantKeyExistsResultSchema.parse(result).exists;
+function isTenantKeyKnown(systemQuery, key) {
+    return existsViaSystemQuery(systemQuery, HostRoutingQueries.tenantKeyExists, { key });
+}
+function isHostKnown(systemQuery, host) {
+    return existsViaSystemQuery(systemQuery, HostRoutingQueries.hostTenantExists, { host });
 }
 function serve(surface, file = surface.file) {
     return surface.csp === undefined

package/dist/host-routing/validate-options.js

@@ -11,6 +11,9 @@ function validateRedirects(options) {
         if (!REDIRECT_PATH_PATTERN.test(rule.from)) {
             throw new Error(`host-routing: redirect from must be a path like "/old", got "${rule.from}"`);
         }
+        if (rule.from === "/api" || rule.from.startsWith("/api/")) {
+            throw new Error(`host-routing: redirect from must not be an /api path, it would never fire, got "${rule.from}"`);
+        }
         if (!REDIRECT_TARGET_PATTERN.test(rule.to)) {
             throw new Error(`host-routing: redirect to must be a same-origin path or an https URL without query, got "${rule.to}"`);
         }

package/dist/inbound-mail-foundation/feature.js

@@ -58,6 +58,7 @@ import { mailAccountEditScreen, mailAccountListScreen } from "./screens.js";
 import { INBOUND_MAIL_TENANT_DESTROY_ARCHIVE_REASON, inboundMessageTenantDestroyHook, mailAccountTenantDestroyHook, mailThreadTenantDestroyHook, } from "./tenant-destroy-hook.js";
 export function createInboundMailFoundationFeature() {
     return defineFeature(INBOUND_MAIL_FOUNDATION_FEATURE, (r) => {
+        r.adoptsBundledLists();
         r.describe("Plugin host for inbound e-mail (inbox federation) — provider plugins (inbound-provider-imap, later M365 Graph / Gmail REST) register at the `inboundMailProvider` extension point with verify/fetch and optional oauth/watch (live push). The foundation owns three event-sourced streams (mail-account lifecycle, inbound-message with exactly-once ingest via deterministic aggregate ids, mail-thread rollup) and their projections `read_mail_accounts`/`read_inbound_messages`/`read_mail_threads`; PII fields are envelope-encrypted per tenant subject key before every append (crypto-shredding on tenant destroy). Wire `createInboundMailConnectRoutes` (OAuth connect + anonymous callback outside /api) and `createInboundMailSupervisor` (IDLE watch with backoff + reconciliation poll) in bin/server.ts. Consume `inbound-mail-foundation:event:inbound-message-received` from app features to attach business processes.");
         r.uiHints({
             displayLabel: "Inbound Mail · Foundation",

package/dist/inbound-mail-foundation/handlers/update-account.write.d.ts

@@ -1,4 +1,4 @@
-import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
+import { type WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 export declare const updateAccountSchema: z.ZodObject<{
     accountId: z.ZodUUID;
@@ -9,6 +9,6 @@ export declare const updateAccountSchema: z.ZodObject<{
     }>>;
     watchState: z.ZodOptional<z.ZodString>;
     displayName: z.ZodOptional<z.ZodString>;
-    reason: z.ZodString;
+    reason: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export declare const updateAccountHandler: WriteHandlerDef;

package/dist/inbound-mail-foundation/handlers/update-account.write.js

@@ -2,6 +2,8 @@
 // error/backoff, OAuth refresh fails (auth_error), or a tenant admin re-enables
 // the account after fixing its credentials. Full-snapshot event: loads the
 // latest state, merges the delta fields, and appends the new snapshot.
+import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
+import { SYSTEM_USER_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { failNotFound, failUnprocessable } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { InboundMailAccountStatuses } from "../constants.js";
@@ -19,10 +21,16 @@ export const updateAccountSchema = z.object({
     /** Ops-Signal ("idle", "watching", "backoff:3", ...). */
     watchState: z.string().max(100).optional(),
     displayName: z.string().max(200).optional(),
-    /** Audit reason for metadata.headers ("watch_supervisor",
-     *  "oauth_refresh", "tenant_admin"). */
-    reason: z.string().min(1).max(100),
+    /** Audit reason for metadata.headers, honored for the system identity only
+     *  ("watch_supervisor", "oauth_refresh"); user callers get a role-derived reason. */
+    reason: z.string().min(1).max(100).optional(),
 });
+const SYSTEM_FALLBACK_REASON = "system";
+function auditReasonFor(user, requestedReason) {
+    if (user.id === SYSTEM_USER_ID)
+        return requestedReason ?? SYSTEM_FALLBACK_REASON;
+    return user.roles.includes(ROLES.SystemAdmin) ? "system_admin" : "tenant_admin";
+}
 export const updateAccountHandler = {
     name: "update-account",
     schema: updateAccountSchema,
@@ -52,7 +60,7 @@ export const updateAccountHandler = {
         };
         const headers = {
             providerName: current.provider,
-            reason: payload.reason,
+            reason: auditReasonFor(event.user, payload.reason),
         };
         await ctx.unsafeAppendEvent({
             aggregateId: payload.accountId,

package/dist/inbound-mail-foundation/i18n.js

@@ -31,5 +31,4 @@ export const INBOUND_MAIL_FOUNDATION_I18N = {
     },
     [formFieldKey("accountId")]: { en: "Mailbox" },
     [formFieldKey("displayName")]: { en: "Name" },
-    [formFieldKey("reason")]: { en: "Reason" },
 };

package/dist/inbound-mail-foundation/screens.js

@@ -63,8 +63,6 @@ export const mailAccountListScreen = {
     access: MAIL_ACCOUNT_ADMIN_ACCESS,
     dormant: true,
 };
-// The reason is the audit label update-account requires; it is not in the
-// layout, so the default is what gets written.
 export const mailAccountEditScreen = {
     id: MAIL_ACCOUNT_EDIT_SCREEN_ID,
     type: "actionForm",
@@ -73,7 +71,6 @@ export const mailAccountEditScreen = {
     fields: {
         accountId: { type: "text", required: true },
         displayName: { type: "text", required: true, maxLength: 200 },
-        reason: { type: "text", default: "tenant_admin" },
     },
     layout: {
         sections: [{ fields: [{ field: "accountId", readOnly: true }, "displayName"] }],

package/dist/inbound-mail-foundation/types.d.ts

@@ -8,8 +8,9 @@ import { INBOUND_MAIL_PROVIDER_EXTENSION, type InboundMailAccountStatus } from "
  *   config   — tenant config reads (host/port/... of the plugins)
  *   registry — extension lookup in the factory (not plugin-internal)
  *   secrets  — tenant secret reads (IMAP password, OAuth refresh token)
- *   auditUserId  — audit identity for secret reads. Handler path: the dispatcher
- *              sets the caller user ID; worker path: system identity.
+ *   auditUserId  — audit identity for secret reads. Handler path: unset,
+ *              requireSecretsContext falls back to ctx.user.id; worker/provider
+ *              path: system identity set by the resolver.
  *   metricsFor — metrics handle of a feature by name, same behavior as
  *              HandlerContext.metricsFor: unregistered metrics are a silent
  *              no-op instead of a throw.
@@ -146,7 +147,7 @@ export type InboundMailProviderPlugin = {
          *  for password accounts and providers without an oauth flow. */
         readonly accessToken?: string;
         /** Batch lookup of the provider message ids not yet ingested for this
-         *  account (committed seen anchors, one query per call). Call it after
+         *  account (committed seen anchors; lists of any size are fine, queried in chunks). Call it after
          *  the listing/delta page and download MIME only for the returned ids.
          *  Ingest dedup stays the correctness anchor; this only saves downloads. */
         readonly filterUnknownMessageIds?: (providerMessageIds: readonly string[]) => Promise<ReadonlySet<string>>;

package/dist/inbound-mail-foundation/watch-supervisor.js

@@ -66,6 +66,7 @@ const DEFAULT_WATCH_LEASE_TTL_SECONDS = 90;
 /** One cursor per account (one mailbox inbox) for now; multi-folder support
  *  can add further scopes later without a schema change. */
 const CURSOR_SCOPE = "default";
+const SEEN_LOOKUP_CHUNK_SIZE = 1000;
 export function createInboundMailSupervisor(deps) {
     const pollIntervalMs = deps.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
     const backfillWindowDays = deps.backfillWindowDays ?? DEFAULT_BACKFILL_WINDOW_DAYS;
@@ -112,11 +113,20 @@ export function createInboundMailSupervisor(deps) {
         const piiKms = configuredPiiSubjectKms();
         const records = [];
         for (const row of rows) {
-            const decrypted = piiKms
-                ? await decryptPiiFieldValues(row, MAIL_ACCOUNT_PII_FIELDS, piiKms, {
-                    requestId: "inbound-mail-foundation:supervisor:list-accounts",
-                })
-                : row;
+            let decrypted;
+            try {
+                decrypted = piiKms
+                    ? await decryptPiiFieldValues(row, MAIL_ACCOUNT_PII_FIELDS, piiKms, {
+                        requestId: "inbound-mail-foundation:supervisor:list-accounts",
+                    })
+                    : row;
+            }
+            catch (error) {
+                // Class name only: the message may carry ciphertext or key details.
+                const errorName = error instanceof Error ? error.name : "unknown error";
+                log(`inbound-mail: account ${row.id} skipped — address did not decrypt (${errorName})`);
+                continue;
+            }
             const decryptedAddress = decrypted["address"];
             // Falling back to row.address would hand the ciphertext to a provider.
             // One undecryptable account must not stop polling of every other tenant's accounts.
@@ -258,12 +268,19 @@ export function createInboundMailSupervisor(deps) {
         return async (providerMessageIds) => {
             if (providerMessageIds.length === 0)
                 return new Set();
-            const seen = await selectMany(deps.db, seenMessageTable, {
-                tenantId: account.tenantId,
-                accountId: account.id,
-                providerMessageId: { in: providerMessageIds },
-            }, { fields: ["providerMessageId"] });
-            const seenIds = new Set(seen.map((row) => row.providerMessageId));
+            // One bind parameter per id: a full-mailbox listing would exceed Postgres' 65535 limit.
+            const seenIds = new Set();
+            for (let start = 0; start < providerMessageIds.length; start += SEEN_LOOKUP_CHUNK_SIZE) {
+                const seen = await selectMany(deps.db, seenMessageTable, {
+                    tenantId: account.tenantId,
+                    accountId: account.id,
+                    providerMessageId: {
+                        in: providerMessageIds.slice(start, start + SEEN_LOOKUP_CHUNK_SIZE),
+                    },
+                }, { fields: ["providerMessageId"] });
+                for (const row of seen)
+                    seenIds.add(row.providerMessageId);
+            }
             return new Set(providerMessageIds.filter((id) => !seenIds.has(id)));
         };
     }

package/dist/jobs/feature.d.ts

@@ -2,5 +2,6 @@ import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 export type JobsFeatureOptions = {
     readonly retentionDays?: number;
     readonly staleRunTimeoutHours?: number;
+    readonly readRoles?: readonly string[];
 };
 export declare function createJobsFeature(options?: JobsFeatureOptions): FeatureDefinition;