@cosmicdrift/kumiko-framework 0.353.0 → 0.354.1

package/dist/errors/index.js

@@ -1,9 +1,10 @@
-export { AccessDeniedError, ConflictError, FeatureDisabledError, IdempotentReplayError, InternalError, NotFoundError, PreconditionFailedError, RateLimitError, RateLimitUnavailableError, UnauthenticatedError, UnconfiguredError, UniqueViolationError, UnprocessableError, ValidationError, VersionConflictError, } from "./classes.js";
+export { AccessDeniedError, ConflictError, FeatureDisabledError, IdempotentReplayError, InternalError, MemberReadTimeoutError, NotFoundError, PreconditionFailedError, RateLimitError, RateLimitUnavailableError, UnauthenticatedError, UnconfiguredError, UniqueViolationError, UnprocessableError, ValidationError, VersionConflictError, } from "./classes.js";
 export { resolveErrorDocsUrl } from "./docs-url.js";
 export { isKumikoError, KumikoError } from "./kumiko-error.js";
 export { memberResolutionReadOnlyDenied } from "./member-resolution.js";
 export { AgentReasons, FrameworkReasons } from "./reasons.js";
 export { buildErrorLog, serializeError } from "./serialize.js";
+export { subjectErasedConflict } from "./subject-erased.js";
 export { toKumikoError } from "./to-kumiko-error.js";
 export { buildInvalidTransitionDetails } from "./transition-details.js";
 export { failNotFound, failTransition, failUnprocessable, reraiseAsKumikoError, toWriteErrorInfo, writeFailure, } from "./write-error-info.js";

package/dist/errors/reasons.d.ts

@@ -12,6 +12,7 @@ export declare const FrameworkReasons: {
     readonly publicIntakeRequired: "public_intake_required";
     readonly irreversibleOperationRequiresHighRisk: "irreversible_operation_requires_high_risk";
     readonly instructionFieldWriteRequiresHighRisk: "instruction_field_write_requires_high_risk";
+    readonly subjectErased: "subject_erased";
 };
 export type FrameworkReason = (typeof FrameworkReasons)[keyof typeof FrameworkReasons];
 export declare const AgentReasons: {

package/dist/errors/reasons.js

@@ -61,6 +61,9 @@ export const FrameworkReasons = {
     // delegation via ctx.write/writeAs from a lower-risk handler does not
     // inherit the gate.
     instructionFieldWriteRequiresHighRisk: "instruction_field_write_requires_high_risk",
+    // ConflictError: a write touched a personal-data field of a data subject whose
+    // key was erased (crypto-shredding); the subject can no longer receive data.
+    subjectErased: "subject_erased",
 };
 // Reason codes the AI-agent runtime surfaces via `details.reason`. Kept as a
 // sister catalog to FrameworkReasons instead of extending it — see the

package/dist/errors/subject-erased.d.ts

@@ -0,0 +1,2 @@
+import { ConflictError } from "./classes.js";
+export declare function subjectErasedConflict(cause?: unknown): ConflictError;

package/dist/errors/subject-erased.js

@@ -0,0 +1,9 @@
+import { ConflictError } from "./classes.js";
+import { FrameworkReasons } from "./reasons.js";
+export function subjectErasedConflict(cause) {
+    return new ConflictError({
+        message: "the data subject was erased — its personal data can no longer be written",
+        details: { reason: FrameworkReasons.subjectErased },
+        ...(cause instanceof Error && { cause }),
+    });
+}

package/dist/event-store/admin-api.js

@@ -8,7 +8,7 @@
 // Allowlist: samples/*/migration/, scripts/migrations/, die Definition
 // selbst, das Guard-Script selbst.
 import { constraintOf, isUniqueViolation } from "../db/pg-error.js";
-import { claimXactId } from "../db/queries/event-store.js";
+import { claimXactId, runAtomicEventWrite } from "../db/queries/event-store.js";
 import { eventPredecessorExists, findExistingEventVersion, insertRawEventBatch, insertRawFirstEvent, insertRawSubsequentEvent, } from "../db/queries/event-store-admin.js";
 import { IdempotentAppendConflictError, VersionConflictError } from "./errors.js";
 function mapEventUniqueViolation(e, event) {
@@ -26,13 +26,15 @@ export async function appendRaw(runner, event) {
     try {
         // See db/queries/event-store.ts's claimXactId — gap-finality needs a
         // real xact id assigned before this holder's insert.
-        await claimXactId(runner);
-        if (event.expectedVersion === 0) {
-            await insertRawFirst(runner, event, newVersion, eventVersion);
-        }
-        else {
-            await insertRawSubsequent(runner, event, newVersion, eventVersion);
-        }
+        await runAtomicEventWrite(runner, async (tx) => {
+            await claimXactId(tx);
+            if (event.expectedVersion === 0) {
+                await insertRawFirst(tx, event, newVersion, eventVersion);
+            }
+            else {
+                await insertRawSubsequent(tx, event, newVersion, eventVersion);
+            }
+        });
     }
     catch (e) {
         if (isUniqueViolation(e)) {
@@ -90,8 +92,10 @@ export async function appendRawBatch(runner, events) {
         return `($${baseIdx + 1}::uuid, $${baseIdx + 2}, $${baseIdx + 3}::uuid, $${baseIdx + 4}, $${baseIdx + 5}, $${baseIdx + 6}, $${baseIdx + 7}::jsonb, $${baseIdx + 8}::jsonb, $${baseIdx + 9}::timestamptz, $${baseIdx + 10})`;
     });
     try {
-        await claimXactId(runner);
-        await insertRawEventBatch(runner, valuesClauses.join(", "), params);
+        await runAtomicEventWrite(runner, async (tx) => {
+            await claimXactId(tx);
+            await insertRawEventBatch(tx, valuesClauses.join(", "), params);
+        });
     }
     catch (e) {
         if (isUniqueViolation(e)) {

package/dist/event-store/event-store.d.ts

@@ -24,6 +24,7 @@ export declare function loadAggregateAsOf(db: DbRunner, aggregateId: string, ten
     readonly includeArchived?: boolean;
 }): Promise<readonly StoredEvent[]>;
 export declare function getStreamVersion(db: DbRunner, aggregateId: string, tenantId: TenantId): Promise<number>;
+export declare function getStreamVersions(db: DbRunner, aggregateIds: readonly string[], tenantId: TenantId): Promise<Map<string, number>>;
 /** MAX(version) for one aggregate — no tenant filter. SECURITY: existence-oracle,
  *  a caller can probe whether an aggregateId has any events regardless of tenant
  *  membership. Only call from seed/system-internal paths (idempotency checks

package/dist/event-store/event-store.js

@@ -4,7 +4,7 @@ import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { requestContext } from "../api/request-context.js";
 import { encryptEventPayloadPii } from "../crypto/event-pii.js";
 import { constraintOf, isUniqueViolation } from "../db/pg-error.js";
-import { claimXactId, insertSubsequentEventRow, notifyPgChannel, selectAggregateMaxVersion, selectEventsHighWaterMark, selectStreamMaxVersion, } from "../db/queries/event-store.js";
+import { claimXactId, insertSubsequentEventRow, notifyPgChannel, runAtomicEventWrite, selectAggregateMaxVersion, selectEventsHighWaterMark, selectStreamMaxVersion, selectStreamMaxVersions, } from "../db/queries/event-store.js";
 import { insertOne, selectMany } from "../db/query.js";
 import { isStreamArchived } from "./archive.js";
 import { IdempotentAppendConflictError, VersionConflictError } from "./errors.js";
@@ -50,14 +50,16 @@ export async function append(db, event) {
     const newVersion = toStore.expectedVersion + 1;
     const eventVersion = toStore.eventVersion ?? 1;
     try {
-        await claimXactId(db);
-        const row = toStore.expectedVersion === 0
-            ? await insertFirstEvent(db, toStore, newVersion, eventVersion, seedCreatedAt)
-            : await insertSubsequentEvent(db, toStore, newVersion, eventVersion, seedCreatedAt);
-        // NOTIFY after the INSERT: outside a transaction each statement commits
-        // on its own, so a NOTIFY sent first would wake the dispatcher before
-        // the row exists.
-        await notifyPgChannel(db, EVENTS_PUBSUB_CHANNEL);
+        const row = await runAtomicEventWrite(db, async (runner) => {
+            await claimXactId(runner);
+            const inserted = toStore.expectedVersion === 0
+                ? await insertFirstEvent(runner, toStore, newVersion, eventVersion, seedCreatedAt)
+                : await insertSubsequentEvent(runner, toStore, newVersion, eventVersion, seedCreatedAt);
+            // NOTIFY after the INSERT and inside the same transaction: PG delivers it on
+            // commit, so the dispatcher cannot wake before the row is visible.
+            await notifyPgChannel(runner, EVENTS_PUBSUB_CHANNEL);
+            return inserted;
+        });
         return buildStoredEvent(toStore, newVersion, eventVersion, row);
     }
     catch (e) {
@@ -221,6 +223,9 @@ export async function loadAggregateAsOf(db, aggregateId, tenantId, asOf, options
 export async function getStreamVersion(db, aggregateId, tenantId) {
     return selectStreamMaxVersion(db, aggregateId, tenantId);
 }
+export async function getStreamVersions(db, aggregateIds, tenantId) {
+    return selectStreamMaxVersions(db, aggregateIds, tenantId);
+}
 /** MAX(version) for one aggregate — no tenant filter. SECURITY: existence-oracle,
  *  a caller can probe whether an aggregateId has any events regardless of tenant
  *  membership. Only call from seed/system-internal paths (idempotency checks

package/dist/event-store/events-schema.js

@@ -1,7 +1,7 @@
 // sql now comes from native dialect
 import { bigserial, index, instant, integer, jsonb, table as pgTable, sql, text, uniqueIndex, uuid, } from "../db/dialect.js";
 import { tableExists } from "../db/index.js";
-import { ensureIdempotencyKeyIndex } from "../db/queries/event-store.js";
+import { ensureIdempotencyKeyIndex, ensureMembershipPayloadTenantIndex, } from "../db/queries/event-store.js";
 import { unsafePushTables } from "../stack/index.js";
 import { createArchivedStreamsTable } from "./archive.js";
 import { createSnapshotsTable } from "./snapshot.js";
@@ -61,6 +61,7 @@ export async function createEventsTable(db) {
     // that predate the idempotency-key index get healed the same way
     // ensureSnapshotVersionColumn heals kumiko_snapshots.
     await ensureIdempotencyKeyIndex(db);
+    await ensureMembershipPayloadTenantIndex(db);
     await createArchivedStreamsTable(db);
     await createSnapshotsTable(db);
 }

package/dist/event-store/index.d.ts

@@ -2,7 +2,7 @@ export { APP_INSTANCE_STREAM_TYPE, APP_STARTED_EVENT_TYPE } from "../crypto/syst
 export { backfillEventPiiEncryption, backfillEventPiiEncryptionBatch, type PiiBackfillBatchOptions, type PiiBackfillBatchResult, type PiiBackfillFailure, type PiiBackfillOptions, type PiiBackfillResult, type PiiBackfillScanCache, } from "../db/queries/backfill-pii.js";
 export { type ArchiveStreamArgs, archivedStreamsTable, archiveStream, createArchivedStreamsTable, isStreamArchived, restoreStream, } from "./archive.js";
 export { ArchivedStreamError, IdempotentAppendConflictError, VersionConflictError, } from "./errors.js";
-export { append, EVENTS_PUBSUB_CHANNEL, type EventMetadata, type EventToAppend, getEventsHighWaterMark, getStreamVersion, getUnscopedAggregateStreamMaxVersion, getUnscopedStreamMaxVersionForSeed, LOAD_ALL_EVENTS_ROW_LIMIT, loadAggregate, loadAggregateAsOf, loadAllEventsByType, loadEventsAfterVersion, type StoredEvent, streamAllEventsByType, } from "./event-store.js";
+export { append, EVENTS_PUBSUB_CHANNEL, type EventMetadata, type EventToAppend, getEventsHighWaterMark, getStreamVersion, getStreamVersions, getUnscopedAggregateStreamMaxVersion, getUnscopedStreamMaxVersionForSeed, LOAD_ALL_EVENTS_ROW_LIMIT, loadAggregate, loadAggregateAsOf, loadAllEventsByType, loadEventsAfterVersion, type StoredEvent, streamAllEventsByType, } from "./event-store.js";
 export { createEventsTable, eventsTable } from "./events-schema.js";
 export { appendProvenanceEvent, type ProvenanceEventInput } from "./provenance-append.js";
 export { createRebuildDeadLetterTable, listRebuildDeadLetters, type RebuildDeadLetterRow, rebuildDeadLetterTable, recordRebuildDeadLetters, type SkippedApply, } from "./rebuild-dead-letter.js";

package/dist/event-store/index.js

@@ -2,7 +2,7 @@ export { APP_INSTANCE_STREAM_TYPE, APP_STARTED_EVENT_TYPE } from "../crypto/syst
 export { backfillEventPiiEncryption, backfillEventPiiEncryptionBatch, } from "../db/queries/backfill-pii.js";
 export { archivedStreamsTable, archiveStream, createArchivedStreamsTable, isStreamArchived, restoreStream, } from "./archive.js";
 export { ArchivedStreamError, IdempotentAppendConflictError, VersionConflictError, } from "./errors.js";
-export { append, EVENTS_PUBSUB_CHANNEL, getEventsHighWaterMark, getStreamVersion, getUnscopedAggregateStreamMaxVersion, getUnscopedStreamMaxVersionForSeed, LOAD_ALL_EVENTS_ROW_LIMIT, loadAggregate, loadAggregateAsOf, loadAllEventsByType, loadEventsAfterVersion, streamAllEventsByType, } from "./event-store.js";
+export { append, EVENTS_PUBSUB_CHANNEL, getEventsHighWaterMark, getStreamVersion, getStreamVersions, getUnscopedAggregateStreamMaxVersion, getUnscopedStreamMaxVersionForSeed, LOAD_ALL_EVENTS_ROW_LIMIT, loadAggregate, loadAggregateAsOf, loadAllEventsByType, loadEventsAfterVersion, streamAllEventsByType, } from "./event-store.js";
 export { createEventsTable, eventsTable } from "./events-schema.js";
 export { appendProvenanceEvent } from "./provenance-append.js";
 export { createRebuildDeadLetterTable, listRebuildDeadLetters, rebuildDeadLetterTable, recordRebuildDeadLetters, } from "./rebuild-dead-letter.js";

package/dist/files/file-handle.d.ts

@@ -2,6 +2,6 @@ import type { FileContext, FileHandle } from "@cosmicdrift/kumiko-types/file-han
 import type { FileStorageProvider } from "./types.js";
 export type { FileContext, FileHandle };
 export declare function createFileHandle(key: string, getProvider: () => Promise<FileStorageProvider>): FileHandle;
-export declare function createFileContext(resolve: () => Promise<FileStorageProvider>): FileContext;
+export declare function createFileContext(resolve: () => Promise<FileStorageProvider>, tenantId?: string): FileContext;
 export declare function deriveKey(key: string, suffix: string): string;
 export declare function storageKeyStemPrefix(key: string): string;

package/dist/files/file-handle.js

@@ -7,8 +7,10 @@
 // the bytes, and big files stay in the storage layer where they belong.
 //
 // `derive(suffix)` is the primitive for thumbnail/variant keys: it inserts a
-// suffix before the file extension — `foo/bar.jpg` + `"medium"` →
-// `foo/bar.medium.jpg`. Stable, reversible, no extra lookup tables.
+// suffix before the file extension — `foo/bar.jpg` + `"medium-<16 hex>"` →
+// `foo/bar.medium-<16 hex>.jpg`. The suffix must be a `variantSuffix(...)` so
+// the erasure sweep recognizes it. Stable, reversible, no extra lookup tables.
+import { isDerivativeSuffix } from "../derivatives/variant-key.js";
 // `getProvider` is a lazily-resolved, memoized accessor — the provider is
 // resolved (config + s3.secretAccessKey secret read) only when a handle method
 // actually does I/O, never on every request that merely builds a ctx.
@@ -19,7 +21,15 @@ export function createFileHandle(key, getProvider) {
         write: async (data, mimeType) => (await getProvider()).write(key, data, mimeType),
         delete: async () => (await getProvider()).delete(key),
         exists: async () => (await getProvider()).exists(key),
-        derive: (suffix) => createFileHandle(deriveKey(key, suffix), getProvider),
+        derive: (suffix) => {
+            // A suffix outside the derivative grammar would write a key that the
+            // forget/tenant-destroy sweep (isDerivativeKeyOf) can never recognize,
+            // so the binary would survive erasure.
+            if (!isDerivativeSuffix(suffix)) {
+                throw new Error(`FileHandle.derive: suffix "${suffix}" must be <name>-<16 hex chars>; build it with variantSuffix(name, spec)`);
+            }
+            return createFileHandle(deriveKey(key, suffix), getProvider);
+        },
     };
 }
 // `resolve` is a tenant-bound thunk (the caller binds the tenant). The result
@@ -27,15 +37,29 @@ export function createFileHandle(key, getProvider) {
 // produces — never a process-global cache, since each FileContext is bound to a
 // single request/event tenant; sharing would leak one tenant's provider (and
 // its bucket/credentials) to another.
-export function createFileContext(resolve) {
+//
+// With `tenantId`, `ref` and `list` only accept keys/prefixes inside `${tenantId}/` —
+// the key space is the isolation boundary in a store shared by several tenants, and
+// a request-derived key or prefix (or "") would otherwise reach every tenant's keys.
+export function createFileContext(resolve, tenantId) {
     let cached;
     const getProvider = () => {
         cached ??= resolve();
         return cached;
     };
     return {
-        ref: (key) => createFileHandle(key, getProvider),
-        list: async (prefix) => (await getProvider()).list(prefix),
+        ref: (key) => {
+            if (tenantId !== undefined && !key.startsWith(`${tenantId}/`)) {
+                throw new Error(`FileContext.ref: key must start with "${tenantId}/"`);
+            }
+            return createFileHandle(key, getProvider);
+        },
+        list: async (prefix) => {
+            if (tenantId !== undefined && !prefix.startsWith(`${tenantId}/`)) {
+                throw new Error(`FileContext.list: prefix must start with "${tenantId}/"`);
+            }
+            return (await getProvider()).list(prefix);
+        },
     };
 }
 // Splits a key into the part before the last dot of its last path segment

package/dist/files/file-routes.js

@@ -13,7 +13,7 @@ import { buildContentDispositionHeader } from "./content-disposition.js";
 import { createFileContext } from "./file-handle.js";
 import { fileRefEntity } from "./file-ref-entity.js";
 import { fileRefsTable } from "./file-ref-table.js";
-import { resolveContentType } from "./resolve-content-type.js";
+import { neutralFileNameForMimeType, resolveContentType } from "./resolve-content-type.js";
 import { buildStorageKey, parseMaxSize, resolveServedContentType, resolveUploadMimeType, validateFile, validateFileContent, } from "./types.js";
 const DEFAULT_PRIVILEGED_ROLES = ["Admin", "SystemAdmin"];
 // 15 minutes — long enough for a download to start, short enough that a
@@ -97,6 +97,7 @@ export function createFileRoutes(options) {
     const api = new Hono();
     const projectionGrants = options.registry ? { projectionRegistry: options.registry } : undefined;
     const tenantDbFor = (tenantId) => createTenantDb(db, tenantId, "tenant", undefined, undefined, undefined, projectionGrants);
+    const fileNameIsPersonal = piiSubjectFields.includes("fileName");
     function kmsContextFor() {
         return { requestId: requestContext.get()?.requestId ?? "file-routes" };
     }
@@ -311,7 +312,7 @@ export function createFileRoutes(options) {
         }
         // Built per request: createFileContext caches the resolved provider, so
         // one shared across requests would serve tenant A's store to tenant B.
-        const files = createFileContext(() => options.resolveProvider(user.tenantId));
+        const files = createFileContext(() => options.resolveProvider(user.tenantId), user.tenantId);
         const derivatives = createDerivativesContext({
             files,
             registry,
@@ -397,10 +398,15 @@ export function createFileRoutes(options) {
         const expiresInSeconds = SIGNED_URL_DEFAULT_EXPIRY_SECONDS;
         const url = await storageProvider.getSignedUrl(fileRef.storageKey, expiresInSeconds, {
             // Hint the provider to set Content-Disposition so the browser prompts
-            // with the original filename instead of the UUID-based storage key.
+            // with a readable filename instead of the UUID-based storage key.
             // Sanitised via buildContentDispositionHeader — the same attacker-
             // controlled fileName reaches the provider's presigned response.
-            contentDisposition: buildContentDispositionHeader(await resolveFileName(fileRef)),
+            // A personal fileName never goes into the URL: the signed query string
+            // lands in storage access logs and proxies and outlives a crypto-shred.
+            // The streaming route keeps the real name in a response header only.
+            contentDisposition: buildContentDispositionHeader(fileNameIsPersonal
+                ? neutralFileNameForMimeType(fileRef.mimeType)
+                : await resolveFileName(fileRef)),
         });
         const expiresAt = new Date(Date.now() + expiresInSeconds * 1000).toISOString();
         return c.json({ url, expiresAt });

package/dist/files/resolve-content-type.d.ts

@@ -1,3 +1,5 @@
+/** A name derived from the MIME type alone, for places a personal file name must not appear. */
+export declare function neutralFileNameForMimeType(mimeType: string): string;
 /**
  * Content type for a file whose sender may not have declared a useful one
  * (mail attachments commonly arrive as application/octet-stream). A concrete

package/dist/files/resolve-content-type.js

@@ -26,6 +26,14 @@ const EXTENSION_FALLBACK = {
     csv: "text/csv",
     txt: "text/plain",
 };
+const EXTENSION_BY_MIME_TYPE = new Map(Object.entries(EXTENSION_FALLBACK)
+    .reverse()
+    .map(([extension, mime]) => [mime, extension]));
+/** A name derived from the MIME type alone, for places a personal file name must not appear. */
+export function neutralFileNameForMimeType(mimeType) {
+    const extension = EXTENSION_BY_MIME_TYPE.get(normalizeMimeType(mimeType));
+    return extension === undefined ? "download" : `download.${extension}`;
+}
 function hasPrefix(bytes, prefix) {
     return prefix.every((byte, i) => bytes[i] === byte);
 }

package/dist/i18n/required-surface-keys.d.ts

@@ -10,6 +10,8 @@ export declare const PROJECTION_DETAIL_ENTITY = "__projection-detail__";
  *  drawn from the host record's display entity). */
 export declare const WRITE_FORM_SECTION_ENTITY = "__write-form-section__";
 export declare function fieldLabelKey(featureName: string, entityName: string, fieldName: string): string;
+export declare function handlerTitleKey(handlerQn: string): string;
+export declare function handlerFieldLabelKey(handlerQn: string, fieldName: string): string;
 export declare function booleanFacetOptionKeys(featureName: string, entityName: string, fieldName: string): readonly string[];
 export declare function selectFacetOptionKey(featureName: string, entityName: string, fieldName: string, value: string): string;
 export declare function screenTitleKey(screenId: string): string;

package/dist/i18n/required-surface-keys.js

@@ -13,6 +13,12 @@ export const WRITE_FORM_SECTION_ENTITY = "__write-form-section__";
 export function fieldLabelKey(featureName, entityName, fieldName) {
     return `${featureName}:entity:${entityName}:field:${fieldName}`;
 }
+export function handlerTitleKey(handlerQn) {
+    return `${handlerQn}:title`;
+}
+export function handlerFieldLabelKey(handlerQn, fieldName) {
+    return `${handlerQn}:field:${fieldName}`;
+}
 export function booleanFacetOptionKeys(featureName, entityName, fieldName) {
     const base = `${featureName}:entity:${entityName}:field:${fieldName}:option`;
     return [`${base}:true`, `${base}:false`];
@@ -116,6 +122,8 @@ function pushDashboardPanelKeys(out, panel) {
 function pushDashboardChartRangeKeys(out, panel) {
     for (const option of panel.ranges?.options ?? [])
         pushKey(out, option.label);
+    for (const kind of Object.values(panel.markerKinds ?? {}))
+        pushKey(out, kind.label);
 }
 function pushDashboardFilterKeys(out, filter) {
     pushKey(out, filter.label);

package/dist/jobs/index.d.ts

@@ -1,2 +1,2 @@
-export type { JobLogEntry, JobMeta, JobOutcomeMeta, JobRunner, JobRunnerOptions, JobSubjectValue, } from "./job-runner.js";
+export type { JobLogEntry, JobMeta, JobOutcomeMeta, JobQueuedMeta, JobRunner, JobRunnerOptions, JobSubjectValue, } from "./job-runner.js";
 export { createJobRunner, serializeJobSubject } from "./job-runner.js";

package/dist/jobs/job-runner.d.ts

@@ -19,6 +19,14 @@ export type JobMeta = {
     payload?: string | undefined;
     attempt?: number | undefined;
     priority?: number | undefined;
+    tenantVisibleRun?: {
+        readonly tenantId: string;
+        readonly subject: string | null;
+    } | undefined;
+};
+export type JobQueuedMeta = {
+    readonly tenantId: string;
+    readonly subject: string | null;
 };
 export type JobOutcomeMeta = {
     readonly tenantId: string;
@@ -27,6 +35,9 @@ export type JobOutcomeMeta = {
         readonly subject: string | null;
         readonly messageKey: string | null;
     } | undefined;
+    readonly tenantVisibleRun?: {
+        readonly subject: string | null;
+    } | undefined;
 };
 export type JobSubjectValue = string | number | boolean | null;
 export declare function serializeJobSubject(subject: Readonly<Record<string, JobSubjectValue>>): string;
@@ -53,5 +64,7 @@ export type JobRunnerOptions = {
     onJobStart?: (jobName: string, jobId: string, meta: JobMeta) => void;
     onJobComplete?: (jobName: string, jobId: string, duration: number, logs: JobLogEntry[], outcome?: JobOutcomeMeta) => void;
     onJobFailed?: (jobName: string, jobId: string, error: string, logs: JobLogEntry[], outcome?: JobOutcomeMeta) => void;
+    onJobQueued?: (jobName: string, jobId: string, meta: JobQueuedMeta) => void;
+    onJobDropped?: (jobName: string, jobId: string) => void;
 };
 export declare function createJobRunner(options: JobRunnerOptions): JobRunner;