@cosmicdrift/kumiko-bundled-features 0.387.0 → 0.389.0

package/dist/jobs/feature.js

@@ -9,8 +9,8 @@ import { reindexEntityJob, reindexEntityPayloadSchema } from "./handlers/reindex
 import { createRetentionCleanupJob, DEFAULT_JOB_RUN_RETENTION_DAYS, } from "./handlers/retention-cleanup.job.js";
 import { retryWrite } from "./handlers/retry.write.js";
 import { createStaleRunSweepJob, DEFAULT_JOB_RUN_STALE_TIMEOUT_HOURS, } from "./handlers/stale-run-sweep.job.js";
-import { tenantFailuresQuery } from "./handlers/tenant-failures.query.js";
-import { tenantRunsQuery } from "./handlers/tenant-runs.query.js";
+import { createTenantFailuresQuery } from "./handlers/tenant-failures.query.js";
+import { createTenantRunsQuery } from "./handlers/tenant-runs.query.js";
 import { triggerWrite } from "./handlers/trigger.write.js";
 import { jobRunLogsTableMeta, jobRunsTableMeta } from "./job-run-table.js";
 import { eventConsumerDetailScreen, eventConsumersScreen, jobRunDetailScreen, jobRunsScreen, jobTriggerScreen, } from "./screens.js";
@@ -20,7 +20,12 @@ import { JOBS_I18N } from "./web/i18n.js";
 export function createJobsFeature(options = {}) {
     const retentionDays = options.retentionDays ?? DEFAULT_JOB_RUN_RETENTION_DAYS;
     const staleRunTimeoutHours = options.staleRunTimeoutHours ?? DEFAULT_JOB_RUN_STALE_TIMEOUT_HOURS;
+    const readRoles = options.readRoles ?? [];
+    if (readRoles.includes("anonymous")) {
+        throw new Error(`createJobsFeature: readRoles must not contain "anonymous" — job status and failures are only readable by members of the tenant.`);
+    }
     return defineFeature("jobs", (r) => {
+        r.adoptsBundledLists();
         r.describe("Persistence and operator tooling for background jobs registered via `r.job(...)`. Every job execution writes directly into `store_job_runs` (current status + duration) and `store_job_run_logs` (per-line log rows) from the BullMQ callbacks — no event stream in between (#2243). A daily `retention-cleanup` job deletes runs (and their logs) older than `retentionDays`; an hourly `stale-run-sweep` job marks runs stuck at status `running` past `staleRunTimeoutHours` as `failed` (#2246 — a crashed worker never fires the completion callback, so nothing else ever revisits the row). Exposes `jobs:write:trigger` (manual run) and `jobs:write:retry` (operator retry of a failed run), plus `jobs:query:list`, `jobs:query:details`, and `jobs:query:catalog` (manual jobs) for the operator UI. A job that declares `tenantVisibleFailure` also records its last failed attempt per tenant and subject in `store_tenant_job_failures`, which the tenant itself reads through `jobs:query:failures` — a translation key only, never the provider's message (fw#3079). A job that declares `tenantVisibleRun` also keeps its run state per tenant and subject in `store_tenant_job_runs` (queued, running, plus the latest completed or failed run, no payload, error text or logs), which the tenant reads through `jobs:query:tenant-runs` (fw#3616); the stale-run sweep fails its stuck `running` rows and drops `queued` rows older than `retentionDays`.");
         r.uiHints({
             displayLabel: "Jobs · Audit & Operator UI",
@@ -79,8 +84,8 @@ export function createJobsFeature(options = {}) {
             list: r.queryHandler(listQuery),
             detail: r.queryHandler(detailQuery),
             catalog: r.queryHandler(catalogQuery),
-            failures: r.queryHandler(tenantFailuresQuery),
-            tenantRuns: r.queryHandler(tenantRunsQuery),
+            failures: r.queryHandler(createTenantFailuresQuery(readRoles)),
+            tenantRuns: r.queryHandler(createTenantRunsQuery(readRoles)),
             consumers: r.queryHandler(consumersQuery),
             consumerDetails: r.queryHandler(consumerDetailQuery),
         };

package/dist/jobs/handlers/tenant-failures.query.d.ts

@@ -1,5 +1,5 @@
 import * as z from "zod";
-export declare const tenantFailuresQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"failures", z.ZodObject<{
+export declare function createTenantFailuresQuery(readRoles: readonly string[]): import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"failures", z.ZodObject<{
     jobName: z.ZodOptional<z.ZodString>;
     subject: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
     limit: z.ZodOptional<z.ZodNumber>;

package/dist/jobs/handlers/tenant-failures.query.js

@@ -20,45 +20,49 @@ function parseSubject(stored) {
         return null;
     return Object.fromEntries(parsed.filter(isSubjectEntry));
 }
-export const tenantFailuresQuery = defineQueryHandler({
-    name: "failures",
-    description: "Lists the calling tenant's own failed jobs — one record per job and subject, newest first, each carrying a translation key for the reason, never the provider's own error message; the optional subject filter matches exactly: all declared subjectFields with the same JSON types as the job payload; use it to tell a tenant that their asynchronous job failed instead of leaving the screen waiting.",
-    schema: z.object({
-        jobName: z.string().optional(),
-        subject: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).optional(),
-        limit: z.number().int().min(1).max(200).optional(),
-    }),
-    // Every membership rank: a failure record carries a job name and a
-    // translation key, nothing a team member of the tenant may not see.
-    access: { roles: access.roles("User", "Editor", ...access.admin) },
-    handler: async (query, ctx) => {
-        if (!ctx.systemDb) {
-            throw new InternalError({
-                message: "jobs:query:failures requires ctx.systemDb (feature must declare r.systemScope())",
+export function createTenantFailuresQuery(readRoles) {
+    return defineQueryHandler({
+        name: "failures",
+        description: "Lists the calling tenant's own failed jobs — one record per job and subject, newest first, each carrying a translation key for the reason, never the provider's own error message; the optional subject filter matches exactly: all declared subjectFields with the same JSON types as the job payload; use it to tell a tenant that their asynchronous job failed instead of leaving the screen waiting.",
+        schema: z.object({
+            jobName: z.string().optional(),
+            subject: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).optional(),
+            limit: z.number().int().min(1).max(200).optional(),
+        }),
+        // Every membership rank: a failure record carries a job name and a
+        // translation key, nothing a team member of the tenant may not see.
+        access: {
+            roles: [...new Set([...access.roles("User", "Editor", ...access.admin), ...readRoles])],
+        },
+        handler: async (query, ctx) => {
+            if (!ctx.systemDb) {
+                throw new InternalError({
+                    message: "jobs:query:failures requires ctx.systemDb (feature must declare r.systemScope())",
+                });
+            }
+            // assertTenantMatch is a self-check on the caller and returns the same
+            // unfiltered system-mode db (tenant-db.ts) — the explicit tenantId below
+            // is the filter, assertRowsTenant the second net. There is no
+            // cross-tenant mode here: SystemAdmin reads runs via jobs:query:list.
+            const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
+            const where = { tenantId: [query.user.tenantId] };
+            if (query.payload.jobName)
+                where["jobName"] = query.payload.jobName;
+            if (query.payload.subject)
+                where["subject"] = serializeJobSubject(query.payload.subject);
+            const rows = await selectMany(db, tenantJobFailuresTable, where, {
+                orderBy: { col: "failedAt", direction: "desc" },
+                limit: query.payload.limit ?? DEFAULT_LIMIT,
             });
-        }
-        // assertTenantMatch is a self-check on the caller and returns the same
-        // unfiltered system-mode db (tenant-db.ts) — the explicit tenantId below
-        // is the filter, assertRowsTenant the second net. There is no
-        // cross-tenant mode here: SystemAdmin reads runs via jobs:query:list.
-        const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
-        const where = { tenantId: [query.user.tenantId] };
-        if (query.payload.jobName)
-            where["jobName"] = query.payload.jobName;
-        if (query.payload.subject)
-            where["subject"] = serializeJobSubject(query.payload.subject);
-        const rows = await selectMany(db, tenantJobFailuresTable, where, {
-            orderBy: { col: "failedAt", direction: "desc" },
-            limit: query.payload.limit ?? DEFAULT_LIMIT,
-        });
-        return {
-            rows: ctx.systemDb.assertRowsTenant(rows, "tenantId").map((row) => ({
-                jobName: row.jobName,
-                subject: parseSubject(row.subject),
-                messageKey: row.messageKey,
-                failedAt: row.failedAt,
-            })),
-            nextCursor: null,
-        };
-    },
-});
+            return {
+                rows: ctx.systemDb.assertRowsTenant(rows, "tenantId").map((row) => ({
+                    jobName: row.jobName,
+                    subject: parseSubject(row.subject),
+                    messageKey: row.messageKey,
+                    failedAt: row.failedAt,
+                })),
+                nextCursor: null,
+            };
+        },
+    });
+}

package/dist/jobs/handlers/tenant-runs.query.d.ts

@@ -1,6 +1,6 @@
 import * as z from "zod";
 import { type TenantJobRunStatus } from "../tenant-job-run-table.ts";
-export declare const tenantRunsQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"tenant-runs", z.ZodObject<{
+export declare function createTenantRunsQuery(readRoles: readonly string[]): import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"tenant-runs", z.ZodObject<{
     jobName: z.ZodOptional<z.ZodString>;
     subject: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
     limit: z.ZodOptional<z.ZodNumber>;

package/dist/jobs/handlers/tenant-runs.query.js

@@ -19,54 +19,58 @@ function parseSubject(stored) {
         return null;
     return Object.fromEntries(parsed.filter(isSubjectEntry));
 }
-export const tenantRunsQuery = defineQueryHandler({
-    name: "tenant-runs",
-    description: "Lists the calling tenant's own job runs that opted in via tenantVisibleRun — per job and subject every queued or running run plus the latest completed or failed one, active runs first, then newest first; each row carries only status and queuedAt/startedAt/finishedAt, never payloads, error text or logs; the optional subject filter matches exactly: all declared subjectFields with the same JSON types as the job payload; use it to show whether work for a subject is waiting, running or done, and to tell a failed run from a finished one.",
-    schema: z.object({
-        jobName: z.string().optional(),
-        subject: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).optional(),
-        limit: z.number().int().min(1).max(200).optional(),
-    }),
-    // Every membership rank: a run state carries a job name, a status and
-    // times, nothing a team member of the tenant may not see.
-    access: { roles: access.roles("User", "Editor", ...access.admin) },
-    handler: async (query, ctx) => {
-        if (!ctx.systemDb) {
-            throw new InternalError({
-                message: "jobs:query:tenant-runs requires ctx.systemDb (feature must declare r.systemScope())",
+export function createTenantRunsQuery(readRoles) {
+    return defineQueryHandler({
+        name: "tenant-runs",
+        description: "Lists the calling tenant's own job runs that opted in via tenantVisibleRun — per job and subject every queued or running run plus the latest completed or failed one, active runs first, then newest first; each row carries only status and queuedAt/startedAt/finishedAt, never payloads, error text or logs; the optional subject filter matches exactly: all declared subjectFields with the same JSON types as the job payload; use it to show whether work for a subject is waiting, running or done, and to tell a failed run from a finished one.",
+        schema: z.object({
+            jobName: z.string().optional(),
+            subject: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).optional(),
+            limit: z.number().int().min(1).max(200).optional(),
+        }),
+        // Every membership rank: a run state carries a job name, a status and
+        // times, nothing a team member of the tenant may not see.
+        access: {
+            roles: [...new Set([...access.roles("User", "Editor", ...access.admin), ...readRoles])],
+        },
+        handler: async (query, ctx) => {
+            if (!ctx.systemDb) {
+                throw new InternalError({
+                    message: "jobs:query:tenant-runs requires ctx.systemDb (feature must declare r.systemScope())",
+                });
+            }
+            // assertTenantMatch returns the same unfiltered system-mode db — the
+            // explicit tenantId below is the filter, assertRowsTenant the second net.
+            const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
+            const where = { tenantId: [query.user.tenantId] };
+            if (query.payload.jobName)
+                where["jobName"] = query.payload.jobName;
+            if (query.payload.subject)
+                where["subject"] = serializeJobSubject(query.payload.subject);
+            const limit = query.payload.limit ?? DEFAULT_LIMIT;
+            const newestFirst = { col: "updatedAt", direction: "desc" };
+            const activeRows = await selectMany(db, tenantJobRunsTable, { ...where, status: { in: ["queued", "running"] } }, { orderBy: newestFirst, limit });
+            const finishedRows = await selectMany(db, tenantJobRunsTable, { ...where, status: { in: ["completed", "failed"] } }, { orderBy: newestFirst, limit });
+            const seenFinishedKeys = new Set();
+            const finishedNewestPerKey = finishedRows.filter((row) => {
+                const key = JSON.stringify([row.jobName, row.subject]);
+                if (seenFinishedKeys.has(key))
+                    return false;
+                seenFinishedKeys.add(key);
+                return true;
             });
-        }
-        // assertTenantMatch returns the same unfiltered system-mode db — the
-        // explicit tenantId below is the filter, assertRowsTenant the second net.
-        const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
-        const where = { tenantId: [query.user.tenantId] };
-        if (query.payload.jobName)
-            where["jobName"] = query.payload.jobName;
-        if (query.payload.subject)
-            where["subject"] = serializeJobSubject(query.payload.subject);
-        const limit = query.payload.limit ?? DEFAULT_LIMIT;
-        const newestFirst = { col: "updatedAt", direction: "desc" };
-        const activeRows = await selectMany(db, tenantJobRunsTable, { ...where, status: { in: ["queued", "running"] } }, { orderBy: newestFirst, limit });
-        const finishedRows = await selectMany(db, tenantJobRunsTable, { ...where, status: { in: ["completed", "failed"] } }, { orderBy: newestFirst, limit });
-        const seenFinishedKeys = new Set();
-        const finishedNewestPerKey = finishedRows.filter((row) => {
-            const key = JSON.stringify([row.jobName, row.subject]);
-            if (seenFinishedKeys.has(key))
-                return false;
-            seenFinishedKeys.add(key);
-            return true;
-        });
-        const activeFirst = [...activeRows, ...finishedNewestPerKey];
-        return {
-            rows: ctx.systemDb.assertRowsTenant(activeFirst.slice(0, limit), "tenantId").map((row) => ({
-                jobName: row.jobName,
-                subject: parseSubject(row.subject),
-                status: row.status,
-                queuedAt: row.queuedAt,
-                startedAt: row.startedAt,
-                finishedAt: row.finishedAt,
-            })),
-            nextCursor: null,
-        };
-    },
-});
+            const activeFirst = [...activeRows, ...finishedNewestPerKey];
+            return {
+                rows: ctx.systemDb.assertRowsTenant(activeFirst.slice(0, limit), "tenantId").map((row) => ({
+                    jobName: row.jobName,
+                    subject: parseSubject(row.subject),
+                    status: row.status,
+                    queuedAt: row.queuedAt,
+                    startedAt: row.startedAt,
+                    finishedAt: row.finishedAt,
+                })),
+                nextCursor: null,
+            };
+        },
+    });
+}

package/dist/jobs/job-run-logger.js

@@ -157,15 +157,16 @@ async function recordTenantRunQueued(db, jobName, bullJobId, meta) {
     const now = Temporal.Now.instant();
     await transaction(db, async (tx) => {
         // A finished row under the same id is left over from before a Redis reset
-        // (ids restart at 1), not this job. Only rows that went through this hook
-        // (queuedAt set) qualify: a fast worker can finish before the hook runs,
-        // and that row is this job's own and must stay.
+        // (ids restart at 1), not this job. Only rows queued before this BullMQ job
+        // was created qualify: a fast worker can finish before the hook runs (no
+        // queuedAt), and a deduplicated add of an already finished job re-announces
+        // it with a creation time older than its own row. Both rows must stay.
         await deleteMany(tx, tenantJobRunsTable, {
             tenantId: key.tenantId,
             jobName,
             bullJobId,
             status: { in: ["completed", "failed"] },
-            queuedAt: { gt: Temporal.Instant.fromEpochMilliseconds(0) },
+            queuedAt: { lt: Temporal.Instant.fromEpochMilliseconds(meta.jobCreatedAtMs) },
         });
         // DO NOTHING: a fast worker can report the start before this enqueue hook
         // returns, and a repeated jobId (debounce, fan-out dedup) is the same job.

package/dist/ledger/web/index.js

@@ -1,7 +1,7 @@
 // Client-safe ledger surface: QN constants, pure recurring helpers
 // (projection + Soll/Ist merge), and Zod payload schemas for client-side
 // pre-validation before dispatch. The full `../ledger` entry also re-exports
-// the feature/handlers/executor, which pull postgres-js; importing it in a
+// the feature/handlers/executor, which pull the DB driver; importing it in a
 // browser bundle fails on Node builtins. Client screens import dispatch QNs and
 // pure forecast/merge helpers from this module, then dispatch via the renderer's
 // useDispatcher.

package/dist/legal-pages/seed.d.ts

@@ -9,4 +9,6 @@ export type LegalContentSeedSource = {
 export type LegalContentSeedFn = (deps: {
     readonly db: DbConnection;
 }) => Promise<void>;
-export declare function legalContentSeed(source: LegalContentSeedSource): LegalContentSeedFn;
+export declare function legalContentSeed(source: LegalContentSeedSource, options?: {
+    readonly folder?: string;
+}): LegalContentSeedFn;

package/dist/legal-pages/seed.js

@@ -28,11 +28,11 @@ async function loadBlocksFromJson(path) {
 }
 // Boot seed for runProdApp's `seeds: [...]`. The JSON template is authoritative
 // (ifExists "update"), so legally required text changes reach rows seeded once.
-export function legalContentSeed(source) {
+export function legalContentSeed(source, options) {
     return async ({ db }) => {
         const blocks = "blocks" in source
             ? legalContentBlocksSchema.parse(source.blocks)
             : await loadBlocksFromJson(source.path);
-        await seedLegalContentFromJson(db, blocks);
+        await seedLegalContentFromJson(db, blocks, options);
     };
 }

package/dist/mail-foundation/feature.d.ts

@@ -20,9 +20,9 @@ export declare const MAIL_TRANSPORT_EXTENSION: "mailTransport";
  *   config      — tenant config reads (the plugin's host/port/from/...)
  *   registry    — extension lookup in the factory (not plugin-internal)
  *   secrets     — tenant secret reads (smtp.password)
- *   auditUserId — audit identity for secret reads. Handler path: the
- *                 dispatcher sets the caller's user id; worker path: the
- *                 r.job wrap sets a system identity.
+ *   auditUserId — audit identity for secret reads. Handler path: unset,
+ *                 requireSecretsContext falls back to ctx.user.id; worker path:
+ *                 the r.job wrap sets a system identity.
  */
 export type MailTransportContext = {
     readonly config?: ConfigAccessor;

package/dist/mail-foundation/feature.js

@@ -147,6 +147,9 @@ export async function createTransportForTenantIfConfigured(ctx, tenantId, handle
 /** The `tenantTransport` resolver for `createChannelEmailFeature`: the tenant's configured
  *  provider, or null so the channel falls back to its app transport. */
 export function tenantMailTransport(scope) {
+    // Without a tenant config the provider cannot be read: use the app transport.
+    if (scope.config === undefined)
+        return Promise.resolve(null);
     return createTransportForTenantIfConfigured({
         config: scope.config,
         registry: scope.registry,

package/dist/mail-transport-smtp/config-keys.js

@@ -4,6 +4,7 @@ import { access, createTenantConfig } from "@cosmicdrift/kumiko-framework/engine
 const tenantAdminWrite = access.withSystem(access.roles("TenantAdmin"));
 const tenantAdminRead = access.roles("TenantAdmin", "SystemAdmin");
 // required: true ↔ the requireNonEmpty calls in buildSmtpTransport — keep in sync.
+// authUser stays optional: empty means an unauthenticated relay.
 export const SMTP_CONFIG_KEYS = {
     host: createTenantConfig("text", {
         required: true,
@@ -39,7 +40,6 @@ export const SMTP_CONFIG_KEYS = {
         },
     }),
     authUser: createTenantConfig("text", {
-        required: true,
         default: "",
         write: tenantAdminWrite,
         read: tenantAdminRead,

package/dist/mail-transport-smtp/feature.js

@@ -76,8 +76,7 @@ export function createMailTransportSmtpFeature() {
                 return `${plaintext.slice(0, 3)}...${plaintext.slice(-2)}`;
             },
             scope: "tenant",
-            // required: true ↔ the missing-secret throw in readPassword — keep in sync.
-            required: true,
+            // Only needed once authUser is set (readPassword throws then), so readiness must not demand it.
         });
         const configKeys = r.config({ keys: SMTP_CONFIG_KEYS });
         r.translations({ keys: MAIL_TRANSPORT_SMTP_I18N });
@@ -126,8 +125,10 @@ async function buildSmtpTransport(ctx, tenantId) {
     const port = requireDefined(await ctxConfig(sharedMailTransportSmtpFeature.exports.configKeys.port), FEATURE_NAME, "port"); // @cast-boundary engine-payload
     const secure = requireDefined(await ctxConfig(sharedMailTransportSmtpFeature.exports.configKeys.secure), FEATURE_NAME, "secure"); // @cast-boundary engine-payload
     const from = requireNonEmpty(await ctxConfig(sharedMailTransportSmtpFeature.exports.configKeys.from), FEATURE_NAME, "from", SMTP_HINT);
-    const authUser = requireNonEmpty(await ctxConfig(sharedMailTransportSmtpFeature.exports.configKeys.authUser), FEATURE_NAME, "authUser", SMTP_HINT);
-    const password = await readPassword(ctx, tenantId);
+    const authUser = (await ctxConfig(sharedMailTransportSmtpFeature.exports.configKeys.authUser))?.trim();
+    const auth = authUser === undefined || authUser === ""
+        ? undefined
+        : { user: authUser, pass: await readPassword(ctx, tenantId) };
     let target;
     try {
         target = await resolveMailConnectTarget(host, {
@@ -155,7 +156,7 @@ async function buildSmtpTransport(ctx, tenantId) {
         port,
         secure,
         from,
-        auth: { user: authUser, pass: password },
+        ...(auth && { auth }),
         ...(target.servername && { servername: target.servername }),
     });
 }

package/dist/managed-pages/constants.d.ts

@@ -0,0 +1 @@
+export declare const MANAGED_PAGES_FEATURE: "managed-pages";

package/dist/managed-pages/constants.js

@@ -0,0 +1 @@
+export const MANAGED_PAGES_FEATURE = "managed-pages";

package/dist/managed-pages/feature.js

@@ -4,6 +4,7 @@ import { RateLimitError } from "@cosmicdrift/kumiko-framework/errors";
 import { cachedSecurePageResponse, EMPTY_BRANDING, renderSafeMarkdown, wrapInLayout, } from "../page-render/index.js";
 import { rateLimitedTextResponse } from "../shared/index.js";
 import { BRANDING_KEYS, BRANDING_QUERY_QN, CUSTOM_CSS_KEY, coerceBranding } from "./branding.js";
+import { MANAGED_PAGES_FEATURE } from "./constants.js";
 import { createBrandingQuery } from "./handlers/branding.query.js";
 import { bySlugQuery } from "./handlers/by-slug.query.js";
 import { byTenantPublishedQuery } from "./handlers/by-tenant-published.query.js";
@@ -79,7 +80,8 @@ export function createManagedPagesFeature(opts) {
     const basePath = opts.basePath ?? "/p";
     const defaultLang = opts.defaultLang ?? "en";
     const allowCustomCss = opts.allowCustomCss ?? false;
-    return defineFeature("managed-pages", (r) => {
+    return defineFeature(MANAGED_PAGES_FEATURE, (r) => {
+        r.adoptsBundledLists();
         r.describe("Tenant-editable, server-rendered public pages with per-tenant branding. Stores one Markdown `page` per `(tenantId, slug, lang)` in the `read_pages` entity table with a `published` gate plus `description`/`ogImage` SEO meta. Registers an anonymous `GET {basePath}/:slug` route that resolves the tenant from the request Host via the app-supplied `resolveApexTenant`, serves only published pages (drafts → 404), renders Markdown through the hardened `page-render` core, and isolates per-tenant content with `Vary: Host`. Ships TenantAdmin/SystemAdmin admin screens (`entityList` + `entityEdit`) backed by convention CRUD handlers (`managed-pages:write:page:{create,update,delete}`, `managed-pages:query:page:{list,detail}`); the app wires nav/workspace onto `managed-pages:screen:page-list`. Also exposes `managed-pages:query:by-tenant-published` (anonymous, SQL-filtered on `published`) for sitemap/discovery consumers such as the `seo` feature. Branding (via `config`, scope tenant): `branding-{title,description,site-url,accent-color,logo-url,layout-preset,custom-css}` keys with write-time validation (hex color, https URLs), a `configEdit` self-service screen (`managed-pages:screen:branding-settings`), and a `managed-pages:query:branding` read that the render path applies as scoped `:root` CSS vars + a logo/title header. Also exposes `managed-pages:write:set` (idempotent slug-keyed upsert, SystemAdmin cross-tenant via `tenantIdOverride`) as a provisioning API. Requires `config` + `anonymousAccess` wired at app bootstrap.");
         r.uiHints({
             displayLabel: "Managed Pages · Public CMS",

package/dist/managed-pages/index.d.ts

@@ -1,5 +1,6 @@
 export { type BrandingTokens, brandingHeaderHtml, brandingStyleBlock, EMPTY_BRANDING, sanitizeTenantCss, TENANT_CONTENT_ATTR, tenantStyleBlock, } from "../page-render/index.ts";
 export { BRANDING_QN, MANAGED_PAGES_CSS_FEATURE } from "./branding.ts";
+export { MANAGED_PAGES_FEATURE } from "./constants.ts";
 export { createManagedPagesCssFeature } from "./css-gate.ts";
 export { createManagedPagesFeature, type ManagedPagesOptions, type ManagedPagesWrapLayout, } from "./feature.ts";
 export { type PageRow, pageEntity, pagesTable } from "./table.ts";

package/dist/managed-pages/index.js

@@ -13,6 +13,7 @@ export { brandingHeaderHtml, brandingStyleBlock, EMPTY_BRANDING, sanitizeTenantC
 // (`config:write:set`) — single source for the `managed-pages:config:branding-*`
 // strings, so apps + the per-tenant migration never hardcode them.
 export { BRANDING_QN, MANAGED_PAGES_CSS_FEATURE } from "./branding.js";
+export { MANAGED_PAGES_FEATURE } from "./constants.js";
 export { createManagedPagesCssFeature } from "./css-gate.js";
 export { createManagedPagesFeature, } from "./feature.js";
 export { pageEntity, pagesTable } from "./table.js";

package/dist/notes-history/handlers/add-note.write.js

@@ -51,7 +51,7 @@ export function createAddNoteHandler(access = DEFAULT_NOTES_HISTORY_ACCESS, entr
             let authorName = null;
             try {
                 // read_users is tenant-agnostic → ctx.db.unsafeRaw, not the tenant-scoped ctx.db.
-                // postgres-js poisons the whole tx after any error inside it, even one that's
+                // Postgres aborts the whole tx after any error inside it, even one that's
                 // caught — so the lookup runs in a savepoint where available, otherwise directly
                 // (pool statements are their own units).
                 authorName = await runInSavepointIfSupported(ctx.db.unsafeRaw(), async (sp) => {

package/dist/personal-access-tokens/feature.d.ts

@@ -2,7 +2,7 @@ import { type FeatureDefinition, type ProjectionListScreenDefinition } from "@co
 import { type CreatePatOptions } from "./handlers/create.write.ts";
 import { type PatRateLimit } from "./web/constants.ts";
 import type { PatScopeConfig } from "./web/scopes.ts";
-export type BindPatAutoRevokeOnPasswordChange = (revoker: (userId: string) => Promise<number>) => void;
+export type BindPatAutoRevokeOnPasswordChange = (revoker: (userId: string) => Promise<number>) => () => void;
 export declare function bindPatAutoRevokeOnPasswordChangeFromFeature(feature: FeatureDefinition): BindPatAutoRevokeOnPasswordChange | undefined;
 export type PersonalAccessTokensOptions = {
     readonly scopes: PatScopeConfig;

package/dist/personal-access-tokens/feature.js

@@ -41,6 +41,7 @@ export function bindPatAutoRevokeOnPasswordChangeFromFeature(feature) {
 export function createPersonalAccessTokensFeature(options) {
     const { scopes } = options;
     return defineFeature(PAT_FEATURE, (r) => {
+        r.adoptsBundledLists();
         r.describe("Long-lived, revocable Personal Access Tokens for headless HTTP-API access. Stores SHA-256 token hashes in the `store_api_tokens` direct-write table; the plaintext is returned once at creation. `create`/`revoke`/`mine` manage a user's own tokens and `available-scopes` lists the app-declared scope catalog. Bearer tokens carrying the PAT prefix are resolved before jwt.verify (roles resolved live, granted scopes enforced fail-closed at the API boundary) — registered as an auth-foundation tokenVerifier provider, resolved generically by the middleware. Pass { toggleable: { default: false } } to tier-gate the whole feature.");
         r.uiHints({ displayLabel: "Personal Access Tokens", category: "identity", recommended: false });
         // Opt-in tier-gating (mirrors ledger/tags): when set, the feature declares
@@ -105,6 +106,10 @@ export function createPersonalAccessTokensFeature(options) {
         });
         const bindAutoRevokeOnPasswordChange = (revoker) => {
             boundAutoRevoke = revoker;
+            return () => {
+                if (boundAutoRevoke === revoker)
+                    boundAutoRevoke = undefined;
+            };
         };
         const handlers = {
             create: r.writeHandler(createPatCreateHandler({ mfaVerifier: options.mfaVerifier })),

package/dist/renderer-pdf/render-table-pdf.d.ts

@@ -44,5 +44,5 @@ export type PdfTableResult = {
     readonly pdfBytes: Uint8Array;
     readonly pageCount: number;
 };
-export declare function renderTablePdf(doc: PdfTableDocument, options?: PdfTableOptions): Promise<PdfTableResult>;
+export declare function renderTablePdf(untrustedDoc: PdfTableDocument, options?: PdfTableOptions): Promise<PdfTableResult>;
 export {};

package/dist/renderer-pdf/render-table-pdf.js

@@ -5,19 +5,28 @@ import { RendererError } from "../renderer-foundation/index.js";
 const PDF_TABLE_MAX_ROWS = 10_000;
 const PDF_TABLE_MAX_COLUMNS = 30;
 const PDF_TABLE_MAX_CELL_LENGTH = 5_000;
+const PDF_TABLE_MAX_META_ENTRIES = 500;
+const PDF_TABLE_MAX_TEXT_LENGTH = 20_000;
+const PDF_TABLE_MAX_PAGE_LABEL_LENGTH = 100;
 const pdfTableColumnSchema = z
     .object({
-    header: z.string(),
+    header: z.string().max(PDF_TABLE_MAX_TEXT_LENGTH),
     weight: z.number().positive().optional(),
     align: z.enum(["left", "right"]).optional(),
 })
     .readonly();
 export const pdfTableDocumentSchema = z
     .object({
-    title: z.string(),
-    subtitle: z.string().optional(),
+    title: z.string().max(PDF_TABLE_MAX_TEXT_LENGTH),
+    subtitle: z.string().max(PDF_TABLE_MAX_TEXT_LENGTH).optional(),
     meta: z
-        .array(z.object({ label: z.string(), value: z.string() }).readonly())
+        .array(z
+        .object({
+        label: z.string().max(PDF_TABLE_MAX_TEXT_LENGTH),
+        value: z.string().max(PDF_TABLE_MAX_TEXT_LENGTH),
+    })
+        .readonly())
+        .max(PDF_TABLE_MAX_META_ENTRIES)
         .readonly()
         .optional(),
     columns: z.array(pdfTableColumnSchema).min(1).max(PDF_TABLE_MAX_COLUMNS).readonly(),
@@ -25,10 +34,10 @@ export const pdfTableDocumentSchema = z
         .array(z.array(z.string().max(PDF_TABLE_MAX_CELL_LENGTH)).readonly())
         .max(PDF_TABLE_MAX_ROWS)
         .readonly(),
-    emptyText: z.string().optional(),
-    footerText: z.string().optional(),
+    emptyText: z.string().max(PDF_TABLE_MAX_TEXT_LENGTH).optional(),
+    footerText: z.string().max(PDF_TABLE_MAX_TEXT_LENGTH).optional(),
     // Template with `{page}` and `{pages}`; default `"{page} / {pages}"`.
-    pageLabel: z.string().optional(),
+    pageLabel: z.string().max(PDF_TABLE_MAX_PAGE_LABEL_LENGTH).optional(),
 })
     .readonly();
 const marginMmSchema = z
@@ -174,10 +183,13 @@ function resolveTableLayout(doc, options, fonts, clean) {
         headerHeight,
     };
 }
-export async function renderTablePdf(doc, options) {
-    if (doc.columns.length === 0) {
-        throw new RendererError("table needs at least one column", "invalid_payload");
+export async function renderTablePdf(untrustedDoc, options) {
+    // Direct callers bypass renderTablePdfRequest, so the size caps are enforced here too.
+    const parsed = pdfTableDocumentSchema.safeParse(untrustedDoc);
+    if (!parsed.success) {
+        throw new RendererError(`table document is invalid: ${parsed.error.message}`, "invalid_payload");
     }
+    const doc = parsed.data;
     assertRowShape(doc);
     const pdf = await PDFDocument.create({ updateMetadata: false });
     const fonts = {

package/dist/secrets/write-gate.js

@@ -6,6 +6,10 @@ function unknownKeyFailure(key) {
         failure: writeFailure(new NotFoundError("secretKey", key, { i18nKey: SECRETS_ERROR_KEYS.unknownKey })),
     };
 }
+function isUnderMountedFeaturePrefix(registry, key) {
+    const separator = key.indexOf(":");
+    return separator > 0 && registry.getFeature(key.slice(0, separator)) !== undefined;
+}
 function namespaceAcceptsKey(namespace, key) {
     const suffix = key.slice(namespace.qualifiedPrefix.length);
     if (suffix.length === 0)
@@ -16,13 +20,15 @@ function namespaceAcceptsKey(namespace, key) {
 // are writable through the API, so a tenant admin cannot plant arbitrary rows
 // next to the feature-owned ones. writeRoles narrows the handler access
 // further for a key or a whole namespace. Delete passes allowUndeclared: it
-// creates nothing, and legacy rows under since-undeclared keys must stay removable.
+// creates nothing, and legacy rows under since-undeclared keys must stay removable,
+// unless the key sits under a mounted feature's prefix: those rows belong to the
+// feature and must not be removable by a tenant admin outside its writeRoles.
 export function checkSecretKeyWrite(registry, userRoles, key, options = {}) {
     const keyDef = registry.getSecretKey(key);
     const namespace = keyDef ? undefined : registry.findSecretNamespace(key);
     if (!keyDef &&
         !(namespace && namespaceAcceptsKey(namespace, key)) &&
-        options.allowUndeclared !== true) {
+        (options.allowUndeclared !== true || isUnderMountedFeaturePrefix(registry, key))) {
         return unknownKeyFailure(key);
     }
     const writeRoles = keyDef?.writeRoles ?? namespace?.writeRoles;

package/dist/sessions/feature.d.ts

@@ -5,7 +5,7 @@ export type SessionsFeatureOptions = {
     readonly expiresInMs?: number;
     readonly adminAccess?: "admin" | "systemAdmin";
 };
-export type BindAutoRevokeOnPasswordChange = (revoker: SessionMassRevoker) => void;
-export type BindRevokeAllOtherSessions = (revoker: SessionAllOthersRevoker) => void;
+export type BindAutoRevokeOnPasswordChange = (revoker: SessionMassRevoker) => () => void;
+export type BindRevokeAllOtherSessions = (revoker: SessionAllOthersRevoker) => () => void;
 export declare function bindAutoRevokeFromFeature(feature: FeatureDefinition): BindAutoRevokeOnPasswordChange | undefined;
 export declare function createSessionsFeature(options?: SessionsFeatureOptions): FeatureDefinition;

package/dist/sessions/feature.js

@@ -48,6 +48,7 @@ export function bindAutoRevokeFromFeature(feature) {
 export function createSessionsFeature(options) {
     return defineFeature("sessions", (r) => {
         const adminRoles = access[options?.adminAccess ?? "admin"];
+        r.adoptsBundledLists();
         r.describe("Tracks signed-in clients in the `store_user_sessions` table (one row per JWT, keyed by the `sid`/`jti` claim) and exposes handlers for `mine` (list your sessions), `revoke`, and `revokeAllOthers`. Session creation and revocation on the hot auth path are handled by `createSessionCallbacks()`, wired into `buildServer({ auth: { ... } })` outside the dispatcher; the same callbacks are also registered as an auth-foundation sessionStore provider, resolvable generically via `resolveSessionStore()`. The feature also ships a manual-trigger cleanup job for pruning expired rows and an optional `autoRevokeOnPasswordChange` hook that mass-revokes all sessions for a user whenever their `passwordHash` changes.");
         r.uiHints({
             displayLabel: "Sessions · Server-side Logout",
@@ -170,6 +171,10 @@ export function createSessionsFeature(options) {
         });
         const bindAutoRevokeOnPasswordChange = (revoker) => {
             boundAutoRevoke = revoker;
+            return () => {
+                if (boundAutoRevoke === revoker)
+                    boundAutoRevoke = undefined;
+            };
         };
         r.translations({ keys: SESSIONS_I18N });
         r.screen(createSessionListScreen(adminRoles));