@cosmicdrift/kumiko-bundled-features 0.388.0 → 0.390.0

package/dist/inbound-mail-foundation/handlers/ingest-message.write.js

@@ -10,7 +10,7 @@
 //      both the event log AND projection contain ciphertext.
 //   4. inbound-message-received append (inline projection writes
 //      read_inbound_messages in the same TX). Savepoint-scoped
-//      (ctx.tryAppendEvent) — a losing concurrent ingest for the same
+//      (ctx.events.tryAppend) — a losing concurrent ingest for the same
 //      messageAggId returns { duplicate: true } instead of failing the TX.
 //   5. Thread rollup: mail-thread-updated append with a recalculated
 //      snapshot (count+1, max(lastMessageAt)) — the apply is a
@@ -116,7 +116,7 @@ export const ingestMessageHandler = {
                 data: { duplicate: true, inboundMessageAggregateId: messageAggId },
             };
         }
-        const existingEvents = await ctx.loadAggregate(messageAggId);
+        const existingEvents = await ctx.events.load(messageAggId);
         if (existingEvents.length > 0) {
             // Stream existiert, Anchor fehlte → Anchor nachziehen, dann raus.
             await ctx.db.insertOne(seenMessageTable, {
@@ -177,7 +177,7 @@ export const ingestMessageHandler = {
             providerName: payload.providerName,
             providerCursor: payload.providerCursor,
         };
-        const messageAppend = await ctx.tryAppendEvent({
+        const messageAppend = await ctx.events.tryAppend({
             aggregateId: messageAggId,
             aggregateType: INBOUND_MESSAGE_AGGREGATE_TYPE,
             type: INBOUND_MESSAGE_RECEIVED_EVENT_QN,
@@ -188,8 +188,8 @@ export const ingestMessageHandler = {
             // Lost the race against a concurrent ingest for the same messageAggId
             // (Watch-Push vs. Poll-Reconciliation overlap). The winner already
             // writes thread-rollup + seen-anchor for this message — steps 5+6
-            // skip here. tryAppendEvent's savepoint keeps this TX usable despite
-            // the caught VersionConflictError (see ctx.tryAppendEvent doc).
+            // skip here. events.tryAppend's savepoint keeps this TX usable despite
+            // the caught VersionConflictError (see ctx.events.tryAppend doc).
             return {
                 isSuccess: true,
                 data: { duplicate: true, inboundMessageAggregateId: messageAggId },
@@ -197,7 +197,7 @@ export const ingestMessageHandler = {
         }
         // ---------------------------------------------------------------
         // 5. Thread-Rollup. New snapshot (live COUNT + max(lastMessageAt)) via
-        //    ctx.tryAppendEvent in a bounded retry loop — the apply stays a
+        //    ctx.events.tryAppend in a bounded retry loop — the apply stays a
         //    dumb, replay-idempotent UPSERT. lastMessageAtIso is not PII (a
         //    timestamp), so it stays plaintext-comparable; subject is
         //    encrypted once up front (constant across retries, doesn't
@@ -209,9 +209,9 @@ export const ingestMessageHandler = {
         //    same thread arriving at once) converge on the true count.
         //    acquireNamespacedAdvisoryLock below serializes this whole
         //    countWhere+append section per threadAggId — transaction-scoped,
-        //    so it survives tryAppendEvent's inner SAVEPOINT and releases at
+        //    so it survives events.tryAppend's inner SAVEPOINT and releases at
         //    the enclosing TX's commit/rollback. Without it, a concurrent
-        //    commit landing between countWhere and tryAppendEvent's own fresh
+        //    commit landing between countWhere and events.tryAppend's own fresh
         //    version-read makes the append succeed with a stale count instead
         //    of a VersionConflictError, so the retry loop below never sees it
         //    as a conflict to retry (the original gap). Unlike step 4, a
@@ -232,7 +232,7 @@ export const ingestMessageHandler = {
         await acquireNamespacedAdvisoryLock(threadRollupRunner, THREAD_ROLLUP_LOCK_NAMESPACE, threadAggId);
         let threadAppendOk = false;
         for (let attempt = 1; attempt <= THREAD_ROLLUP_MAX_ATTEMPTS && !threadAppendOk; attempt++) {
-            const threadEvents = await ctx.loadAggregate(threadAggId);
+            const threadEvents = await ctx.events.load(threadAggId);
             const lastThreadEvent = threadEvents[threadEvents.length - 1];
             // @cast-boundary engine-payload — eigene events, shape via defineEvent
             const previousThread = lastThreadEvent?.payload;
@@ -248,7 +248,7 @@ export const ingestMessageHandler = {
                 lastMessageAtIso: newLastAt,
                 messageCount,
             };
-            const threadAppend = await ctx.tryAppendEvent({
+            const threadAppend = await ctx.events.tryAppend({
                 aggregateId: threadAggId,
                 aggregateType: MAIL_THREAD_AGGREGATE_TYPE,
                 type: MAIL_THREAD_UPDATED_EVENT_QN,

package/dist/inbound-mail-foundation/handlers/update-account.write.js

@@ -62,7 +62,7 @@ export const updateAccountHandler = {
             providerName: current.provider,
             reason: auditReasonFor(event.user, payload.reason),
         };
-        await ctx.unsafeAppendEvent({
+        await ctx.events.unsafeAppend({
             aggregateId: payload.accountId,
             aggregateType: MAIL_ACCOUNT_AGGREGATE_TYPE,
             type: MAIL_ACCOUNT_UPDATED_EVENT_QN,

package/dist/inbound-mail-foundation/projection.js

@@ -3,7 +3,7 @@
 //   inbound-message  → read_inbound_messages  (INSERT-ignore, append-only)
 //   mail-thread      → read_mail_threads      (UPSERT, rollup)
 //
-// Apply runs in the same transaction as ctx.unsafeAppendEvent, providing
+// Apply runs in the same transaction as ctx.events.unsafeAppend, providing
 // read-your-own-write without waiting for a dispatcher tick (as in
 // billing-foundation).
 //

package/dist/inbound-mail-foundation/watch-supervisor.js

@@ -7,7 +7,7 @@
 //
 // **Documented deviation:** the poll was originally intended as an `r.job`
 // cron trigger. JobContext previously had no dispatcher (see
-// run-export-jobs.ts), but now has one (`ctx.write`/`ctx.queryAs`,
+// run-export-jobs.ts), but now has one (`ctx.dispatch.write`/`ctx.dispatch.queryAs`,
 // job-runner.ts). Converting the poll to a cron job is a separate migration
 // because it changes the concurrency model, so this dispatcher contract
 // remains in place. The app owner wires the supervisor in bin/server.ts:

package/dist/inbound-provider-imap/feature.js

@@ -37,7 +37,7 @@ export { setImapMailHostLookup } from "./imap-client.js";
 // Credential-Read — per-Account-Slot, Worker-tauglich (slim ctx).
 // =============================================================================
 async function readCredentialDocument(ctx, account) {
-    const secrets = requireSecretsContext(ctx, FEATURE_NAME);
+    const secrets = requireSecretsContext({ secrets: ctx.secrets, auditUserId: ctx.auditUserId }, FEATURE_NAME);
     const secret = await secrets.get(account.tenantId, inboundCredentialSecretKey(account.id));
     if (!secret) {
         throw new InboundAuthError(`${FEATURE_NAME}: no credential document in secret slot for account ${account.id} — ` +

package/dist/jobs/events.js

@@ -2,7 +2,7 @@
 // backed jobRun's event-store payloads (r.defineEvent + inline projections);
 // now job-run-logger.ts parses against them before writing straight into
 // jobRunsTable/jobRunLogsTable, so an out-of-dispatcher write still gets the
-// same validation guarantee ctx.appendEvent used to give it.
+// same validation guarantee ctx.events.append used to give it.
 import * as z from "zod";
 export const jobLogEntrySchema = z.object({
     level: z.enum(["info", "warn", "error"]),

package/dist/jobs/feature.js

@@ -25,6 +25,7 @@ export function createJobsFeature(options = {}) {
         throw new Error(`createJobsFeature: readRoles must not contain "anonymous" — job status and failures are only readable by members of the tenant.`);
     }
     return defineFeature("jobs", (r) => {
+        r.adoptsBundledLists();
         r.describe("Persistence and operator tooling for background jobs registered via `r.job(...)`. Every job execution writes directly into `store_job_runs` (current status + duration) and `store_job_run_logs` (per-line log rows) from the BullMQ callbacks — no event stream in between (#2243). A daily `retention-cleanup` job deletes runs (and their logs) older than `retentionDays`; an hourly `stale-run-sweep` job marks runs stuck at status `running` past `staleRunTimeoutHours` as `failed` (#2246 — a crashed worker never fires the completion callback, so nothing else ever revisits the row). Exposes `jobs:write:trigger` (manual run) and `jobs:write:retry` (operator retry of a failed run), plus `jobs:query:list`, `jobs:query:details`, and `jobs:query:catalog` (manual jobs) for the operator UI. A job that declares `tenantVisibleFailure` also records its last failed attempt per tenant and subject in `store_tenant_job_failures`, which the tenant itself reads through `jobs:query:failures` — a translation key only, never the provider's message (fw#3079). A job that declares `tenantVisibleRun` also keeps its run state per tenant and subject in `store_tenant_job_runs` (queued, running, plus the latest completed or failed run, no payload, error text or logs), which the tenant reads through `jobs:query:tenant-runs` (fw#3616); the stale-run sweep fails its stuck `running` rows and drops `queued` rows older than `retentionDays`.");
         r.uiHints({
             displayLabel: "Jobs · Audit & Operator UI",

package/dist/jobs/handlers/consumer.write.js

@@ -44,7 +44,7 @@ function defineConsumerWrite(name, description, transition) {
                         ? rejected(JobErrors.consumerUnknown, "jobs.errors.consumerUnknown")
                         : rejected(JobErrors.consumerWrongStatus, "jobs.errors.consumerWrongStatus");
                 }
-                ctx.log?.error(`jobs:write:${name} failed: ${e instanceof Error ? e.message : String(e)}`, {
+                ctx.obs.log?.error(`jobs:write:${name} failed: ${e instanceof Error ? e.message : String(e)}`, {
                     consumer: event.payload.name,
                     instanceId: event.payload.instanceId,
                 });

package/dist/jobs/handlers/projection-rebuild.job.js

@@ -29,6 +29,6 @@ export const projectionRebuildJob = async (rawPayload, ctx) => {
         registry: ctx.registry,
         ...(skipApplyErrors === true && { errorPolicy: { skipApplyErrors: true } }),
     });
-    ctx.log?.info?.(`[jobs:projection-rebuild] rebuilt ${projection}: ${result.eventsProcessed} events` +
+    ctx.obs.log?.info?.(`[jobs:projection-rebuild] rebuilt ${projection}: ${result.eventsProcessed} events` +
         `${result.eventsSkipped > 0 ? ` (${result.eventsSkipped} quarantined)` : ""} in ${result.durationMs}ms`);
 };

package/dist/jobs/handlers/reindex-entity.job.js

@@ -16,15 +16,15 @@ export const reindexEntityJob = async (rawPayload, ctx) => {
             message: "[jobs:reindex-entity] ctx.registry missing — job context requires the registry.",
         });
     }
-    if (!ctx.searchAdapter) {
+    if (!ctx.services.searchAdapter) {
         throw new InternalError({
-            message: "[jobs:reindex-entity] ctx.searchAdapter missing — mount a search adapter to run this job.",
+            message: "[jobs:reindex-entity] ctx.services.searchAdapter missing — mount a search adapter to run this job.",
         });
     }
     // perTenant fan-out — the job-runner enqueues one child run per active
     // tenant with ctx.systemUser scoped to it; a run without one (e.g.
     // misconfigured manual dispatch outside the fan-out) has nothing scoped
-    // to reindex. ctx._tenantId is never populated per-dispatch (only
+    // to reindex. ctx.user.tenantId is never populated per-dispatch (only
     // ctx.systemUser is), so it is not a valid fallback here.
     const tenantId = ctx.systemUser?.tenantId;
     if (tenantId === undefined) {
@@ -40,7 +40,7 @@ export const reindexEntityJob = async (rawPayload, ctx) => {
     // filters `WHERE tenant_id = $1` itself with this same tenantId.
     ctx.systemDb.assertTenantMatch(tenantId);
     const db = ctx.systemDb.unsafeRaw("reindexEntity filters WHERE tenant_id = $1 itself with this job's tenantId");
-    const result = await reindexEntity(db, ctx.registry, ctx.searchAdapter, entity, tenantId);
-    ctx.log?.info?.(`[jobs:reindex-entity] tenant=${tenantId} reindexed ${entity}: ${result.indexedRows}/${result.scannedRows} rows indexed` +
+    const result = await reindexEntity(db, ctx.registry, ctx.services.searchAdapter, entity, tenantId);
+    ctx.obs.log?.info?.(`[jobs:reindex-entity] tenant=${tenantId} reindexed ${entity}: ${result.indexedRows}/${result.scannedRows} rows indexed` +
         `${result.failures.length > 0 ? ` (${result.failures.length} failed)` : ""}`);
 };

package/dist/jobs/handlers/retention-cleanup.job.js

@@ -11,6 +11,6 @@ export function createRetentionCleanupJob(retentionDays) {
         }
         const db = ctx.systemDb.unsafeRaw("store_job_runs retention purges finished runs of every tenant"); // @cast-boundary db-operator — DbRunner narrows to DbConnection, jobs never run inside a DbTx
         const result = await deleteStaleJobRuns(db, retentionDays);
-        ctx.log?.info?.(`[jobs:retention-cleanup] complete: ${JSON.stringify(result)}`);
+        ctx.obs.log?.info?.(`[jobs:retention-cleanup] complete: ${JSON.stringify(result)}`);
     };
 }

package/dist/jobs/handlers/retry.write.js

@@ -22,7 +22,7 @@ export const retryWrite = defineWriteHandler({
         }
         const db = ctx.systemDb.acknowledgeCrossTenant("cross-tenant job monitoring");
         // @cast-boundary engine-payload — JobRunner attached by app-boot via ctx-extension
-        const jobRunner = ctx["jobRunner"];
+        const jobRunner = ctx.services.jobRunner;
         const run = await fetchOne(db, jobRunsTable, { id: event.payload.runId });
         if (!run) {
             return writeFailure(new NotFoundError("jobRun", event.payload.runId, {

package/dist/jobs/handlers/stale-run-sweep.job.js

@@ -18,6 +18,6 @@ export function createStaleRunSweepJob(timeoutHours, queuedRetentionDays) {
         }
         const db = ctx.systemDb.unsafeRaw("stale-run sweep marks stuck runs of every tenant as failed"); // @cast-boundary db-operator — DbRunner narrows to DbConnection, jobs never run inside a DbTx
         const result = await markStaleJobRunsFailed(db, timeoutHours, queuedRetentionDays);
-        ctx.log?.info?.(`[jobs:stale-run-sweep] complete: ${JSON.stringify(result)}`);
+        ctx.obs.log?.info?.(`[jobs:stale-run-sweep] complete: ${JSON.stringify(result)}`);
     };
 }

package/dist/jobs/handlers/trigger.write.js

@@ -18,8 +18,8 @@ export const triggerWrite = defineWriteHandler({
     access: { roles: ["SystemAdmin"] },
     handler: async (event, ctx) => {
         const registry = ctx.registry;
-        // `jobRunner` is a dynamic context extension — not a core HandlerContext field.
-        const jobRunner = ctx["jobRunner"]; // @cast-boundary dynamic-key
+        // `services.jobRunner` is typed as the handleEvent-only JobRunnerRef; dispatch lives on the concrete runner.
+        const jobRunner = ctx.services.jobRunner; // @cast-boundary engine-bridge
         const jobDef = registry.getJob(event.payload.jobName);
         if (!jobDef) {
             return writeFailure(new NotFoundError("job", event.payload.jobName, {

package/dist/jobs/job-run-logger.d.ts

@@ -7,4 +7,5 @@ export type JobRunLoggerOptions = {
 };
 export type JobRunLoggerCallbacks = Pick<JobRunnerOptions, "onJobStart" | "onJobComplete" | "onJobFailed" | "onJobDeferred" | "onJobQueued" | "onJobDropped">;
 export declare function encryptFailureError(error: string, triggeredById: string | null): Promise<string>;
+export declare function isolateTenantRunWrite(write: () => Promise<void>, jobName: string, bullJobId: string): Promise<void>;
 export declare function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallbacks;

package/dist/jobs/job-run-logger.js

@@ -1,6 +1,8 @@
 import { configuredPiiSubjectKms, encryptPiiValueForSubject, KeyErasedError, PII_ERASED_SENTINEL, } from "@cosmicdrift/kumiko-framework/crypto";
 import { acquireNamespacedAdvisoryLock, deleteMany, fetchOne, insertMany, insertOnConflictDoNothing, insertOne, transaction, updateMany, upsertOnConflict, } from "@cosmicdrift/kumiko-framework/db";
-import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { parseTenantId, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import { isRowLevelSecurityViolation, runInRowLevelSecurityScope, tenantRowLevelSecurityScope, } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { mapWithConcurrency } from "../shared/index.js";
@@ -27,6 +29,15 @@ const DEFAULT_CACHE_TTL_MS = 60 * 60 * 1000; // 1 hour
 // Run rows hang on SYSTEM_TENANT_ID and a null trigger is a cron/system run;
 // job-run-table.ts declares whenAbsent: "tenant" for exactly that case, so the
 // logger must resolve the same subject the entity chain would.
+// Job callbacks run outside any request scope; the tenant tables enforce their rows per tenant, so each write
+// declares the tenant it belongs to.
+function inTenantScope(tenantId, work) {
+    const parsed = parseTenantId(tenantId);
+    if (parsed === null) {
+        throw new InternalError({ message: `job run logger got a malformed tenant id "${tenantId}"` });
+    }
+    return runInRowLevelSecurityScope(tenantRowLevelSecurityScope(parsed), work);
+}
 function jobRunSubject(triggeredById) {
     return triggeredById === null
         ? { kind: "tenant", tenantId: SYSTEM_TENANT_ID }
@@ -126,7 +137,7 @@ async function recordTenantJobFailure(db, jobName, outcome) {
     // partial unique indexes (subject NULL vs. set) are no ON CONFLICT target.
     // The lock makes the later of two racing final failures replace the earlier
     // one; the indexes are the backstop against any writer that skips the lock.
-    await transaction(db, async (tx) => {
+    await inTenantScope(where.tenantId, () => transaction(db, async (tx) => {
         await acquireNamespacedAdvisoryLock(tx, TENANT_JOB_FAILURE_LOCK_NAMESPACE, JSON.stringify([where["tenantId"], where["jobName"], where["subject"]]));
         await deleteMany(tx, tenantJobFailuresTable, where);
         await insertOne(tx, tenantJobFailuresTable, {
@@ -134,14 +145,14 @@ async function recordTenantJobFailure(db, jobName, outcome) {
             messageKey,
             failedAt: Temporal.Now.instant(),
         });
-    });
+    }));
 }
 async function clearTenantJobFailure(db, jobName, outcome) {
     const where = tenantJobFailureTarget(jobName, outcome);
     // skip: no tenant-visible target — nothing was ever recorded
     if (!where)
         return;
-    await deleteMany(db, tenantJobFailuresTable, where);
+    await inTenantScope(where.tenantId, () => deleteMany(db, tenantJobFailuresTable, where));
 }
 function tenantRunKey(jobName, tenantId, subject) {
     // skip: tenant-less run (cron resolves to SYSTEM_TENANT_ID) — no tenant-scoped query could read it
@@ -155,7 +166,7 @@ async function recordTenantRunQueued(db, jobName, bullJobId, meta) {
     if (!key)
         return;
     const now = Temporal.Now.instant();
-    await transaction(db, async (tx) => {
+    await inTenantScope(key.tenantId, () => transaction(db, async (tx) => {
         // A finished row under the same id is left over from before a Redis reset
         // (ids restart at 1), not this job. Only rows queued before this BullMQ job
         // was created qualify: a fast worker can finish before the hook runs (no
@@ -171,7 +182,7 @@ async function recordTenantRunQueued(db, jobName, bullJobId, meta) {
         // DO NOTHING: a fast worker can report the start before this enqueue hook
         // returns, and a repeated jobId (debounce, fan-out dedup) is the same job.
         await insertOnConflictDoNothing(tx, tenantJobRunsTable, { ...key, bullJobId, status: "queued", queuedAt: now, updatedAt: now }, { conflictKeys: [...TENANT_RUN_CONFLICT_KEYS] });
-    });
+    }));
 }
 async function recordTenantRunStarted(db, jobName, bullJobId, meta) {
     // skip: job did not opt in to tenantVisibleRun
@@ -182,10 +193,10 @@ async function recordTenantRunStarted(db, jobName, bullJobId, meta) {
     if (!key)
         return;
     const now = Temporal.Now.instant();
-    await upsertOnConflict(db, tenantJobRunsTable, { ...key, bullJobId, status: "running", startedAt: now, updatedAt: now }, {
+    await inTenantScope(key.tenantId, () => upsertOnConflict(db, tenantJobRunsTable, { ...key, bullJobId, status: "running", startedAt: now, updatedAt: now }, {
         conflictKeys: [...TENANT_RUN_CONFLICT_KEYS],
         update: { status: "running", startedAt: now, finishedAt: null, updatedAt: now },
-    });
+    }));
 }
 async function recordTenantRunOutcome(db, jobName, bullJobId, outcome, result) {
     // skip: job did not opt in to tenantVisibleRun
@@ -199,7 +210,7 @@ async function recordTenantRunOutcome(db, jobName, bullJobId, outcome, result) {
     // A failed attempt BullMQ will retry goes back to waiting: the tenant keeps
     // seeing pending work, not a failure the next attempt may still resolve.
     if (result === "failed" && !outcome.finalAttempt) {
-        await updateMany(db, tenantJobRunsTable, { status: "queued", startedAt: null, finishedAt: null, updatedAt: now }, { tenantId: key.tenantId, jobName, bullJobId });
+        await inTenantScope(key.tenantId, () => updateMany(db, tenantJobRunsTable, { status: "queued", startedAt: null, finishedAt: null, updatedAt: now }, { tenantId: key.tenantId, jobName, bullJobId }));
         // skip: retry pending, the row stays active until the final attempt
         return;
     }
@@ -207,7 +218,7 @@ async function recordTenantRunOutcome(db, jobName, bullJobId, outcome, result) {
     // one it replaces. The per-key lock keeps two runs of the same subject that
     // finish together from each missing the other's uncommitted row and leaving
     // both behind.
-    await transaction(db, async (tx) => {
+    await inTenantScope(key.tenantId, () => transaction(db, async (tx) => {
         await acquireNamespacedAdvisoryLock(tx, TENANT_JOB_RUN_LOCK_NAMESPACE, JSON.stringify([key.tenantId, key.jobName, key.subject]));
         // Read under the lock: the run that finishes last in lock order must also carry the
         // latest finishedAt, otherwise a stale timestamp makes it the row that gets pruned.
@@ -221,7 +232,7 @@ async function recordTenantRunOutcome(db, jobName, bullJobId, outcome, result) {
             status: { in: ["completed", "failed"] },
             bullJobId: { ne: bullJobId },
         });
-    });
+    }));
 }
 async function requeueTenantRun(db, jobName, bullJobId, meta) {
     // skip: job did not opt in to tenantVisibleRun
@@ -231,25 +242,29 @@ async function requeueTenantRun(db, jobName, bullJobId, meta) {
     // skip: system-tenant run, no tenant-scoped query reads it
     if (!key)
         return;
-    await updateMany(db, tenantJobRunsTable, { status: "queued", startedAt: null, finishedAt: null, updatedAt: Temporal.Now.instant() }, { tenantId: key.tenantId, jobName, bullJobId });
+    await inTenantScope(key.tenantId, () => updateMany(db, tenantJobRunsTable, { status: "queued", startedAt: null, finishedAt: null, updatedAt: Temporal.Now.instant() }, { tenantId: key.tenantId, jobName, bullJobId }));
 }
 async function dropTenantRunQueued(db, jobName, bullJobId, meta) {
-    await deleteMany(db, tenantJobRunsTable, {
+    await inTenantScope(meta.tenantId, () => deleteMany(db, tenantJobRunsTable, {
         tenantId: meta.tenantId,
         jobName,
         bullJobId,
         status: "queued",
-    });
+    }));
 }
 const log = createFallbackLogger("job-run-logger");
 // The tenant run state is an optional side write: a throw here must not
 // fail the enqueue, skip the run-row write or turn a completed run into a
-// BullMQ retry.
-async function isolateTenantRunWrite(write, jobName, bullJobId) {
+// BullMQ retry. A row-level-security rejection is logged louder (a missing or wrong tenant scope), never rethrown.
+export async function isolateTenantRunWrite(write, jobName, bullJobId) {
     try {
         await write();
     }
     catch (e) {
+        if (isRowLevelSecurityViolation(e)) {
+            log.error("tenant job run state write rejected by row level security: missing or wrong tenant scope", { jobName, bullJobId });
+            return;
+        }
         log.error("tenant job run state write failed", {
             jobName,
             bullJobId,
@@ -258,12 +273,17 @@ async function isolateTenantRunWrite(write, jobName, bullJobId) {
     }
 }
 // The tenant failure record is an optional side write: a throw here must not
-// skip the run-row update or turn a completed run into a BullMQ retry.
+// skip the run-row update or turn a completed run into a BullMQ retry. A row-level-security rejection is
+// logged louder (a missing or wrong tenant scope), never rethrown.
 async function isolateTenantFailureWrite(write, jobName, bullJobId) {
     try {
         await write();
     }
     catch (e) {
+        if (isRowLevelSecurityViolation(e)) {
+            log.error("tenant job failure record write rejected by row level security: missing or wrong tenant scope", { jobName, bullJobId });
+            return;
+        }
         log.error("tenant job failure record write failed", {
             jobName,
             bullJobId,
@@ -340,7 +360,7 @@ export function createJobRunLogger(opts) {
             const triggeredById = meta.triggeredById ?? null;
             cachePut(bullJobId, runId, triggeredById);
             // Parse against the registered schema so out-of-dispatcher writes
-            // get the same validation guarantee as ctx.appendEvent. A shape
+            // get the same validation guarantee as ctx.events.append. A shape
             // drift between feature + logger fails loudly at the source
             // instead of silently landing on the table.
             const payload = runStartedSchema.parse({

package/dist/ledger/web/index.js

@@ -1,7 +1,7 @@
 // Client-safe ledger surface: QN constants, pure recurring helpers
 // (projection + Soll/Ist merge), and Zod payload schemas for client-side
 // pre-validation before dispatch. The full `../ledger` entry also re-exports
-// the feature/handlers/executor, which pull postgres-js; importing it in a
+// the feature/handlers/executor, which pull the DB driver; importing it in a
 // browser bundle fails on Node builtins. Client screens import dispatch QNs and
 // pure forecast/merge helpers from this module, then dispatch via the renderer's
 // useDispatcher.

package/dist/legal-pages/lib/boot-check.d.ts

@@ -1,10 +1,16 @@
 import { type TemplateResolverApi } from "@cosmicdrift/kumiko-bundled-features/template-resolver";
 import { type LegalRequiredBlock } from "../web/constants.ts";
 export type LegalPagesBootCheckCtx = {
-    readonly templateResolver?: TemplateResolverApi;
-    readonly log?: {
-        readonly info?: (msg: string) => void;
-        readonly warn?: (msg: string) => void;
+    readonly services: {
+        readonly extensions: {
+            readonly templateResolver?: TemplateResolverApi;
+        };
+    };
+    readonly obs?: {
+        readonly log?: {
+            readonly info?: (msg: string) => void;
+            readonly warn?: (msg: string) => void;
+        };
     };
 };
 export declare function runLegalPagesBootCheck(ctx: LegalPagesBootCheckCtx, requiredBlocks?: readonly LegalRequiredBlock[]): Promise<void>;

package/dist/legal-pages/lib/boot-check.js

@@ -19,7 +19,7 @@ export async function runLegalPagesBootCheck(ctx, requiredBlocks = LEGAL_REQUIRE
         }
     }
     if (missing.length === 0) {
-        ctx.log?.info?.("legal-pages boot-check: alle Pflicht-Blocks vorhanden");
+        ctx.obs?.log?.info?.("legal-pages boot-check: alle Pflicht-Blocks vorhanden");
     }
     else {
         const message = `legal-pages: missing ${missing.length} required text-block(s) in SYSTEM_TENANT: ` +
@@ -28,6 +28,6 @@ export async function runLegalPagesBootCheck(ctx, requiredBlocks = LEGAL_REQUIRE
         if (process.env["NODE_ENV"] === "production") {
             throw new Error(`Boot-Validation failed: ${message}`);
         }
-        ctx.log?.warn?.(message);
+        ctx.obs?.log?.warn?.(message);
     }
 }

package/dist/legal-pages/seed.d.ts

@@ -9,4 +9,6 @@ export type LegalContentSeedSource = {
 export type LegalContentSeedFn = (deps: {
     readonly db: DbConnection;
 }) => Promise<void>;
-export declare function legalContentSeed(source: LegalContentSeedSource): LegalContentSeedFn;
+export declare function legalContentSeed(source: LegalContentSeedSource, options?: {
+    readonly folder?: string;
+}): LegalContentSeedFn;

package/dist/legal-pages/seed.js

@@ -28,11 +28,11 @@ async function loadBlocksFromJson(path) {
 }
 // Boot seed for runProdApp's `seeds: [...]`. The JSON template is authoritative
 // (ifExists "update"), so legally required text changes reach rows seeded once.
-export function legalContentSeed(source) {
+export function legalContentSeed(source, options) {
     return async ({ db }) => {
         const blocks = "blocks" in source
             ? legalContentBlocksSchema.parse(source.blocks)
             : await loadBlocksFromJson(source.path);
-        await seedLegalContentFromJson(db, blocks);
+        await seedLegalContentFromJson(db, blocks, options);
     };
 }

package/dist/mail-foundation/feature.d.ts

@@ -9,7 +9,7 @@ export declare const MAIL_TRANSPORT_EXTENSION: "mailTransport";
  * **Why not the full HandlerContext?** On the worker path (transport builds
  * triggered by r.job, such as the user-data-rights forget/export cron) there
  * is no per-request `config`/`tx`/`actor`; the wrapper builds the per-tenant
- * ConfigAccessor from `ctx.configResolver`. A plugin reading `ctx.tx` or other
+ * ConfigAccessor from `ctx.services.configResolver`. A plugin reading `ctx.tx` or other
  * request-only fields would break the worker path at runtime, and that would
  * only show up with real SMTP in production. Casting
  * `ctx as unknown as HandlerContext` satisfies the compiler but fails at
@@ -27,7 +27,7 @@ export declare const MAIL_TRANSPORT_EXTENSION: "mailTransport";
 export type MailTransportContext = {
     readonly config?: ConfigAccessor;
     readonly registry?: Registry;
-    readonly secrets?: import("@cosmicdrift/kumiko-framework/secrets").SecretsContext;
+    readonly secrets: import("@cosmicdrift/kumiko-framework/secrets").SecretsContext | undefined;
     readonly auditUserId?: string | undefined;
 };
 /**

package/dist/mail-transport-smtp/config-keys.js

@@ -4,6 +4,7 @@ import { access, createTenantConfig } from "@cosmicdrift/kumiko-framework/engine
 const tenantAdminWrite = access.withSystem(access.roles("TenantAdmin"));
 const tenantAdminRead = access.roles("TenantAdmin", "SystemAdmin");
 // required: true ↔ the requireNonEmpty calls in buildSmtpTransport — keep in sync.
+// authUser stays optional: empty means an unauthenticated relay.
 export const SMTP_CONFIG_KEYS = {
     host: createTenantConfig("text", {
         required: true,
@@ -39,7 +40,6 @@ export const SMTP_CONFIG_KEYS = {
         },
     }),
     authUser: createTenantConfig("text", {
-        required: true,
         default: "",
         write: tenantAdminWrite,
         read: tenantAdminRead,

package/dist/mail-transport-smtp/feature.js

@@ -76,8 +76,7 @@ export function createMailTransportSmtpFeature() {
                 return `${plaintext.slice(0, 3)}...${plaintext.slice(-2)}`;
             },
             scope: "tenant",
-            // required: true ↔ the missing-secret throw in readPassword — keep in sync.
-            required: true,
+            // Only needed once authUser is set (readPassword throws then), so readiness must not demand it.
         });
         const configKeys = r.config({ keys: SMTP_CONFIG_KEYS });
         r.translations({ keys: MAIL_TRANSPORT_SMTP_I18N });
@@ -126,8 +125,10 @@ async function buildSmtpTransport(ctx, tenantId) {
     const port = requireDefined(await ctxConfig(sharedMailTransportSmtpFeature.exports.configKeys.port), FEATURE_NAME, "port"); // @cast-boundary engine-payload
     const secure = requireDefined(await ctxConfig(sharedMailTransportSmtpFeature.exports.configKeys.secure), FEATURE_NAME, "secure"); // @cast-boundary engine-payload
     const from = requireNonEmpty(await ctxConfig(sharedMailTransportSmtpFeature.exports.configKeys.from), FEATURE_NAME, "from", SMTP_HINT);
-    const authUser = requireNonEmpty(await ctxConfig(sharedMailTransportSmtpFeature.exports.configKeys.authUser), FEATURE_NAME, "authUser", SMTP_HINT);
-    const password = await readPassword(ctx, tenantId);
+    const authUser = (await ctxConfig(sharedMailTransportSmtpFeature.exports.configKeys.authUser))?.trim();
+    const auth = authUser === undefined || authUser === ""
+        ? undefined
+        : { user: authUser, pass: await readPassword(ctx, tenantId) };
     let target;
     try {
         target = await resolveMailConnectTarget(host, {
@@ -155,12 +156,12 @@ async function buildSmtpTransport(ctx, tenantId) {
         port,
         secure,
         from,
-        auth: { user: authUser, pass: password },
+        ...(auth && { auth }),
         ...(target.servername && { servername: target.servername }),
     });
 }
 async function readPassword(ctx, tenantId) {
-    const secrets = requireSecretsContext(ctx, FEATURE_NAME);
+    const secrets = requireSecretsContext({ secrets: ctx.secrets, auditUserId: ctx.auditUserId }, FEATURE_NAME);
     const branded = await secrets.get(tenantId, SMTP_PASSWORD);
     return requireSecretSet(branded, FEATURE_NAME, SMTP_PASSWORD.name).reveal();
 }

package/dist/managed-pages/constants.d.ts

@@ -0,0 +1 @@
+export declare const MANAGED_PAGES_FEATURE: "managed-pages";

package/dist/managed-pages/constants.js

@@ -0,0 +1 @@
+export const MANAGED_PAGES_FEATURE = "managed-pages";

package/dist/managed-pages/feature.js

@@ -4,6 +4,7 @@ import { RateLimitError } from "@cosmicdrift/kumiko-framework/errors";
 import { cachedSecurePageResponse, EMPTY_BRANDING, renderSafeMarkdown, wrapInLayout, } from "../page-render/index.js";
 import { rateLimitedTextResponse } from "../shared/index.js";
 import { BRANDING_KEYS, BRANDING_QUERY_QN, CUSTOM_CSS_KEY, coerceBranding } from "./branding.js";
+import { MANAGED_PAGES_FEATURE } from "./constants.js";
 import { createBrandingQuery } from "./handlers/branding.query.js";
 import { bySlugQuery } from "./handlers/by-slug.query.js";
 import { byTenantPublishedQuery } from "./handlers/by-tenant-published.query.js";
@@ -79,7 +80,8 @@ export function createManagedPagesFeature(opts) {
     const basePath = opts.basePath ?? "/p";
     const defaultLang = opts.defaultLang ?? "en";
     const allowCustomCss = opts.allowCustomCss ?? false;
-    return defineFeature("managed-pages", (r) => {
+    return defineFeature(MANAGED_PAGES_FEATURE, (r) => {
+        r.adoptsBundledLists();
         r.describe("Tenant-editable, server-rendered public pages with per-tenant branding. Stores one Markdown `page` per `(tenantId, slug, lang)` in the `read_pages` entity table with a `published` gate plus `description`/`ogImage` SEO meta. Registers an anonymous `GET {basePath}/:slug` route that resolves the tenant from the request Host via the app-supplied `resolveApexTenant`, serves only published pages (drafts → 404), renders Markdown through the hardened `page-render` core, and isolates per-tenant content with `Vary: Host`. Ships TenantAdmin/SystemAdmin admin screens (`entityList` + `entityEdit`) backed by convention CRUD handlers (`managed-pages:write:page:{create,update,delete}`, `managed-pages:query:page:{list,detail}`); the app wires nav/workspace onto `managed-pages:screen:page-list`. Also exposes `managed-pages:query:by-tenant-published` (anonymous, SQL-filtered on `published`) for sitemap/discovery consumers such as the `seo` feature. Branding (via `config`, scope tenant): `branding-{title,description,site-url,accent-color,logo-url,layout-preset,custom-css}` keys with write-time validation (hex color, https URLs), a `configEdit` self-service screen (`managed-pages:screen:branding-settings`), and a `managed-pages:query:branding` read that the render path applies as scoped `:root` CSS vars + a logo/title header. Also exposes `managed-pages:write:set` (idempotent slug-keyed upsert, SystemAdmin cross-tenant via `tenantIdOverride`) as a provisioning API. Requires `config` + `anonymousAccess` wired at app bootstrap.");
         r.uiHints({
             displayLabel: "Managed Pages · Public CMS",

package/dist/managed-pages/index.d.ts

@@ -1,5 +1,6 @@
 export { type BrandingTokens, brandingHeaderHtml, brandingStyleBlock, EMPTY_BRANDING, sanitizeTenantCss, TENANT_CONTENT_ATTR, tenantStyleBlock, } from "../page-render/index.ts";
 export { BRANDING_QN, MANAGED_PAGES_CSS_FEATURE } from "./branding.ts";
+export { MANAGED_PAGES_FEATURE } from "./constants.ts";
 export { createManagedPagesCssFeature } from "./css-gate.ts";
 export { createManagedPagesFeature, type ManagedPagesOptions, type ManagedPagesWrapLayout, } from "./feature.ts";
 export { type PageRow, pageEntity, pagesTable } from "./table.ts";

package/dist/managed-pages/index.js

@@ -13,6 +13,7 @@ export { brandingHeaderHtml, brandingStyleBlock, EMPTY_BRANDING, sanitizeTenantC
 // (`config:write:set`) — single source for the `managed-pages:config:branding-*`
 // strings, so apps + the per-tenant migration never hardcode them.
 export { BRANDING_QN, MANAGED_PAGES_CSS_FEATURE } from "./branding.js";
+export { MANAGED_PAGES_FEATURE } from "./constants.js";
 export { createManagedPagesCssFeature } from "./css-gate.js";
 export { createManagedPagesFeature, } from "./feature.js";
 export { pageEntity, pagesTable } from "./table.js";

package/dist/managed-pages/seeding.d.ts

@@ -1,5 +1,5 @@
 import { type DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { type SessionUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { type SeedIfExists } from "@cosmicdrift/kumiko-framework/seeding";
 export type SeedPageOptions = {
     readonly tenantId: TenantId;