@cosmicdrift/kumiko-framework 0.365.0 → 0.365.1

package/agents/examples/webhook-step.md

@@ -68,7 +68,7 @@ bun test
 ```ts
 // webhook-step integration test — drives r.step.webhook.send end-to-end:
 // handler appends step.dispatch-requested in TX, dispatcher subscription
-// drains after COMMIT and calls the (stubbed) fetch, follow-up
+// enqueues a delivery job after COMMIT, the job calls the (stubbed) fetch, follow-up
 // step.dispatched / step.dispatch-failed events land on the same stream.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, mock, test } from "bun:test";
@@ -140,6 +140,7 @@ beforeAll(async () => {
   stack = await setupTestStack({
     features: [createStepDispatcherFeature(), createSecretsFeature(), webhookDemoFeature],
     systemHooks: [],
+    jobs: { consumerLane: "worker" },
     extraContext: ({ db, registry }) => ({
       secrets: createSecretsContext({ db, masterKeyProvider, registry }),
     }),
@@ -184,6 +185,7 @@ describe("webhook-step Sample", () => {
 
     // Drain dispatcher (MSP runs async via runOnce in test mode)
     await stack.eventDispatcher?.runOnce();
+    await stack.drainJobs();
 
     expect(fetchMock).toHaveBeenCalledTimes(1);
     const [calledUrl, init] = fetchMock.mock.calls[0]!;
@@ -202,6 +204,7 @@ describe("webhook-step Sample", () => {
     expect(id).toMatch(/^[0-9a-f-]{36}$/);
 
     await stack.eventDispatcher?.runOnce();
+    await stack.drainJobs();
 
     expect(mailMock).toHaveBeenCalledTimes(1);
     expect(mailMock).toHaveBeenCalledWith(
@@ -231,6 +234,7 @@ describe("webhook-step Sample", () => {
 
     // And the inner handler's webhook fired
     await stack.eventDispatcher?.runOnce();
+    await stack.drainJobs();
     expect(fetchMock).toHaveBeenCalledTimes(1);
   });
 
@@ -243,6 +247,7 @@ describe("webhook-step Sample", () => {
     expect(res.status).toBe(500);
 
     await stack.eventDispatcher?.runOnce();
+    await stack.drainJobs();
 
     expect(fetchMock).not.toHaveBeenCalled();
     const rows = await selectMany(stack.db, incidentTable);
@@ -261,6 +266,7 @@ describe("access-denied — role-restricted handlers", () => {
     );
     expect(error.code).toBe("access_denied");
     await stack.eventDispatcher?.runOnce();
+    await stack.drainJobs();
     expect(mailMock).not.toHaveBeenCalled();
   });
 
@@ -287,6 +293,7 @@ describe("access-denied — role-restricted handlers", () => {
     );
     expect(error.code).toBe("access_denied");
     await stack.eventDispatcher?.runOnce();
+    await stack.drainJobs();
     expect(fetchMock).not.toHaveBeenCalled();
   });
 });
@@ -317,6 +324,7 @@ describe("incident:open-authenticated — tenant-owned webhook auth secret", ()
       adminB,
     );
     await stack.eventDispatcher?.runOnce();
+    await stack.drainJobs();
 
     expect(fetchMock).toHaveBeenCalledTimes(1);
     const [, init] = fetchMock.mock.calls[0]!;
@@ -348,6 +356,7 @@ describe("incident:open-authenticated — tenant-owned webhook auth secret", ()
       adminA,
     );
     await stack.eventDispatcher?.runOnce();
+    await stack.drainJobs();
 
     expect(fetchMock).not.toHaveBeenCalled();
 
@@ -378,6 +387,7 @@ describe("incident:open-authenticated — tenant-owned webhook auth secret", ()
       adminC,
     );
     await stack.eventDispatcher?.runOnce();
+    await stack.drainJobs();
 
     expect(fetchMock).not.toHaveBeenCalled();
     const failedEvents = await selectMany(stack.db, eventsTable, {

package/agents/features.md

@@ -594,7 +594,7 @@ Exposes APIs: `sessions.revokeAllForUser`
 
 ## step-dispatcher
 
-Internal system feature that drains deferred Tier-2 side-effects (currently `webhook.send` and `mail.send`) after their originating transaction commits. Listens via `r.multiStreamProjection` on the `kumiko:system:step.dispatch-requested` system event, performs the actual HTTP or mail delivery, then appends `kumiko:system:step.dispatched` or `kumiko:system:step.dispatch-failed` back onto the same stream so the outcome is recorded in the event log without a separate status table. Mount this feature explicitly via `createStepDispatcherFeature()` in your app's feature list alongside any features that use `r.step.webhook.send` or `r.step.mail.send`. Requires the `secrets` feature (`createSecretsFeature()`) to be mounted — `webhook.send` auth resolves per-tenant through it, under `step-dispatcher:webhook-auth.<name>`. Every `webhook.send` request carries `Idempotency-Key: <dispatch stream id>`, stable across redeliveries of the same dispatch request; an explicit `Idempotency-Key` in `headers` takes precedence.
+Internal system feature that drains deferred Tier-2 side-effects (currently `webhook.send` and `mail.send`) after their originating transaction commits. An `r.multiStreamProjection` on the `kumiko:system:step.dispatch-requested` system event enqueues one `step-dispatcher:job:deliver` BullMQ job per dispatch (Redis carries only the stream id and tenant, never the request payload). The job performs the actual HTTP or mail delivery and appends `kumiko:system:step.dispatched` or `kumiko:system:step.dispatch-failed` back onto the same stream, so the outcome is recorded in the event log without a separate status table. Transient failures (network error, timeout, 5xx, 408, 429, any mail adapter failure) are retried 3 times with exponential backoff; the outcome is recorded after the final attempt and the payload key is erased only then. Permanent failures (invalid url, blocked host, other 4xx, unavailable auth secret) are recorded immediately. At most 2 deliveries per tenant run at once (`maxPerTenant` with `onLimit: "defer"`), so a slow receiver of one tenant does not delay other tenants. Requires a job runner (Redis) and a worker consuming the job's default `worker` lane; without a job runner the projection fails loudly. Mount this feature explicitly via `createStepDispatcherFeature()` in your app's feature list alongside any features that use `r.step.webhook.send` or `r.step.mail.send`. Requires the `secrets` feature (`createSecretsFeature()`) to be mounted — `webhook.send` auth resolves per-tenant through it, under `step-dispatcher:webhook-auth.<name>`. Every `webhook.send` request carries `Idempotency-Key: <dispatch stream id>`, stable across retries and redeliveries of the same dispatch request; an explicit `Idempotency-Key` in `headers` takes precedence.
 
 Category: infrastructure
 

package/dist/api/server.js

@@ -310,6 +310,13 @@ export function buildServer(options) {
     const searchConsumerEnabled = options.eventDispatcher?.systemConsumers?.search ?? true;
     const jobTriggerConsumerEnabled = options.eventDispatcher?.systemConsumers?.jobTrigger ?? true;
     const jobRunnerForTriggers = options.dispatcherOptions?.jobRunner;
+    const mspJobs = jobRunnerForTriggers?.dispatch
+        ? {
+            dispatch: async (jobName, payload, dispatchOptions) => {
+                await jobRunnerForTriggers.dispatch?.(jobName, payload, dispatchOptions);
+            },
+        }
+        : undefined;
     const systemConsumers = [];
     if (sseConsumerEnabled) {
         systemConsumers.push(createSseBroadcastEventConsumer(sseBroker));
@@ -391,6 +398,7 @@ export function buildServer(options) {
                 ...(mspOwner && { callerFeature: mspOwner }),
                 ...(mspFiles && { files: mspFiles }),
                 ...(contextWithObservability.secrets && { secrets: contextWithObservability.secrets }),
+                ...(mspJobs && { jobs: mspJobs }),
                 ...(mspFiles && {
                     derivatives: createDerivativesContext({
                         files: mspFiles,

package/dist/crypto/in-memory-kms-adapter.js

@@ -1,7 +1,8 @@
 import { randomBytes } from "node:crypto";
 import { KeyAlreadyExistsError, KeyErasedError, KeyNotFoundError, subjectIdToKey, } from "./kms-adapter.js";
 // Non-persistent adapter for tests and dev mode. Erased entries stay as
-// tombstones so the create-after-erase contract holds within a process.
+// tombstones (also for never-keyed subjects) so the create-after-erase
+// contract holds within a process.
 export class InMemoryKmsAdapter {
     capabilities = { mode: "local-key" };
     keys = new Map();
@@ -20,12 +21,8 @@ export class InMemoryKmsAdapter {
         return entry.key;
     }
     async eraseKey(subject) {
-        const entry = this.keys.get(subjectIdToKey(subject));
-        // skip: eraseKey is contractually idempotent — unknown subject is a no-op
-        if (!entry)
-            return;
-        entry.key = null;
-        entry.erased = true;
+        // A never-keyed subject gets a tombstone too, so createKey cannot mint one later.
+        this.keys.set(subjectIdToKey(subject), { key: null, erased: true });
     }
     async health() {
         return { ok: true, latencyMs: 0 };

package/dist/crypto/pg-kms-adapter.js

@@ -107,15 +107,19 @@ export class PgKmsAdapter {
     }
     async eraseKey(subject, ctx) {
         await this.ensureSchema();
-        // Guard on erased_at IS NULL keeps repeat erases from overwriting the
-        // original tombstone audit fields; unknown subjects update zero rows.
+        // Upsert: a never-keyed subject (pre-KMS plaintext) still gets a tombstone,
+        // so a later createKey cannot mint a fresh key and re-encrypt the plaintext.
+        // The erased_at IS NULL guard keeps repeat erases from overwriting the
+        // original tombstone audit fields.
         await this.sql `
-      UPDATE kumiko_subject_keys
+      INSERT INTO kumiko_subject_keys (subject_id, cipher_key, kek_version, erased_at, erased_by, erase_reason)
+      VALUES (${subjectIdToKey(subject)}, NULL, ${this.kekVersion}, now(), ${ctx.userId ?? null}, ${ctx.eraseReason ?? null})
+      ON CONFLICT (subject_id) DO UPDATE
       SET cipher_key = NULL,
           erased_at = now(),
-          erased_by = ${ctx.userId ?? null},
-          erase_reason = ${ctx.eraseReason ?? null}
-      WHERE subject_id = ${subjectIdToKey(subject)} AND erased_at IS NULL`;
+          erased_by = EXCLUDED.erased_by,
+          erase_reason = EXCLUDED.erase_reason
+      WHERE kumiko_subject_keys.erased_at IS NULL`;
     }
     async health() {
         const start = Date.now();

package/dist/db/event-store-executor-write.js

@@ -169,7 +169,7 @@ export function createWriteVerbs(ctx) {
                     failure: writeFailure(new FrameworkVersionConflict({
                         entityId: id,
                         expectedVersion: currentVersion,
-                        currentVersion: -1,
+                        currentVersion: await versionAfterConflict(runner, String(id), streamTenantFor(user, streamTenantId)),
                     })),
                 };
             }
@@ -181,6 +181,16 @@ export function createWriteVerbs(ctx) {
             throw e;
         }
     }
+    // After a lost append race the stream version read before the append is stale;
+    // report the actual one. -1 when the lookup itself fails.
+    async function versionAfterConflict(runner, aggregateId, tenantId) {
+        try {
+            return await getStreamVersion(runner, aggregateId, tenantId);
+        }
+        catch {
+            return -1;
+        }
+    }
     async function expectedStreamVersion(db, id, streamTenant, expect) {
         const snapshot = await loadExpectSnapshot(db, id, streamTenant, Object.keys(expect));
         const row = snapshot.row;
@@ -298,13 +308,7 @@ export function createWriteVerbs(ctx) {
             }
             catch (e) {
                 if (e instanceof EventStoreVersionConflict) {
-                    let currentVersion = -1;
-                    try {
-                        currentVersion = await getStreamVersion(runner, aggregateId, streamTenantFor(user, streamTenantId));
-                    }
-                    catch {
-                        // Lookup failure — keep the sentinel.
-                    }
+                    const currentVersion = await versionAfterConflict(runner, aggregateId, streamTenantFor(user, streamTenantId));
                     return writeFailure(new FrameworkVersionConflict({
                         entityId: aggregateId,
                         expectedVersion: 0,
@@ -603,7 +607,7 @@ export function createWriteVerbs(ctx) {
                     return writeFailure(new FrameworkVersionConflict({
                         entityId: payload.id,
                         expectedVersion: payload.version ?? 0,
-                        currentVersion,
+                        currentVersion: await versionAfterConflict(runner, String(payload.id), streamTenant),
                     }));
                 }
                 if (e instanceof EventStoreIdempotentAppendConflict) {
@@ -675,7 +679,7 @@ export function createWriteVerbs(ctx) {
                     return writeFailure(new FrameworkVersionConflict({
                         entityId: payload.id,
                         expectedVersion: currentVersion,
-                        currentVersion: -1,
+                        currentVersion: await versionAfterConflict(runner, String(payload.id), streamTenantFor(user, streamTenantId)),
                     }));
                 }
                 if (e instanceof EventStoreIdempotentAppendConflict) {
@@ -760,7 +764,7 @@ export function createWriteVerbs(ctx) {
                     return writeFailure(new FrameworkVersionConflict({
                         entityId: payload.id,
                         expectedVersion: currentVersion,
-                        currentVersion: -1,
+                        currentVersion: await versionAfterConflict(runner, String(payload.id), streamTenantFor(user, streamTenantId)),
                     }));
                 }
                 if (e instanceof EventStoreIdempotentAppendConflict) {
@@ -825,7 +829,7 @@ export function createWriteVerbs(ctx) {
             // table. Rows predating the subject-KMS rollout may still hold plaintext
             // pii, and envelope encryption is not idempotent: decrypt, then
             // re-encrypt as delete does.
-            const previousPlain = await decryptForRead(data);
+            const previousPlain = await decryptForRead(rehydrateCompoundTypes(data, entity));
             const appended = await appendRestoredEvent(runner, user, payload.id, previousPlain, streamTenantId, currentVersion);
             if ("failure" in appended)
                 return appended.failure;

package/dist/engine/index.d.ts

@@ -81,7 +81,7 @@ export { assertNotificationVariables, templateVariable, templateVariablesToZod,
 export { type EffectiveFeaturesResolver, findTierResolverUsage, isTierResolverPlugin, requireTierResolverPlugin, TENANT_TIER_RESOLVER_EXT, type TierResolverPlugin, type TrialGate, } from "./tier-resolver-extension.js";
 export { findOverDeepTransferChain, resolveTransferAdjacency as resolveEntityTransferAdjacency, type TransferAdjacency, type TransferEdge, type TransferEdgeLink, } from "./transfer-adjacency.js";
 export { isSystemTenant, isUuid, parseTenantId, SYSTEM_TENANT_ID } from "./types/identifiers.js";
-export type { AccessRule, ActionFormScreenDefinition, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BeforeTransactionPhase, BeforeTransactionResult, BelongsToRelation, BigIntFieldDef, BooleanFieldDef, CamelToKebab, ChatSendFailureCode, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, ConcurrencyMode, ConfigAccessor, ConfigAccessorFactory, ConfigBacking, ConfigCascade, ConfigCascadeLevel, ConfigDefinition, ConfigEditScreenDefinition, ConfigKeyAccess, ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigMask, ConfigResolver, ConfigScope, ConfigSecretsReader, ConfigSeedDef, ConfigStoredRow, ConfigStoredRowWithSource, ConfigValidateContext, ConfigValidateFn, ConfigValue, ConfigValueSource, ConfigValueWithSource, ContentCollectionDefinition, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, CustomScreenDefinition, CustomScreenRoute, DashboardChartPanel, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelVisibility, DashboardProgressListPanel, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextParam, DashboardValueFormat, DateFieldDef, DecimalFieldDef, DeleteContext, DeliveryErrorCode, DeliveryFailureCode, DeliverySkipReason, DeriveContext, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, EditExtensionSection, EditFieldPrefill, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EmbeddedListEditSpec, EntityDefinition, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityId, EntityListExpandableRow, EntityListScreenDefinition, EntityRef, EntityRelations, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, ExtensionOptionsArgs, ExtensionOptionsFor, FeatureDefinition, FeatureRegistrar, FieldAccess, FieldCondition, FieldDefinition, FieldFormatRegistry, FieldIconKey, FieldRenderer, FileFieldDef, FilesFieldDef, Findability, FormatSpec, FormWidth, HandlerContext, HasManyRelation, HookMap, ImageFieldDef, ImagesFieldDef, JobBackoff, JobBackoffStrategy, JobContext, JobDefinition, JobHandlerFn, JobTrigger, JobTriggerEvent, JsonbFieldDef, KumikoEntityTypeMap, KumikoEventTypeMap, KumikoExtensionOptionsMap, KumikoHandlerPayloadMap, KumikoHandlerResultMap, LifecycleHookType, ListColumnSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, LongTextFindability, ManyToManyRelation, MemberReader, MetricNavigate, MetricSpec, MspErrorMode, MspErrorPolicy, MultiSelectFieldDef, MultiStreamApplyFn, MultiStreamProjectionDefinition, NameOrRef, NavDefinition, NavIconKey, NotificationDataFn, NotificationDefinition, NotificationLocalizedTemplate, NotificationRecipientFn, NotificationRecordMapping, NotificationTemplateBody, NotificationTemplateFn, NotificationTemplateMeta, NotifyDeferred, NotifyDelivery, NotifyDeliveryStatus, NotifyDispatched, NotifyFactory, NotifyFn, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, NumberFieldDef, OnDeleteStrategy, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, ParentRefDef, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, PlatformComponent, PluralForms, PostDeleteHookFn, PostSaveHookFn, PreDeleteHookFn, PreparedWriteEvent, PreQueryHookFn, PreSaveHookFn, ProjectionDefinition, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, ProjectionTable, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RateLimitPer, RecordHeaderSpec, RecordHeaderSubtitlePart, ReferenceDataDef, Registry, RelationDefinition, ResolvedPiiFlags, RetentionDef, RoleAccessPersonalData, RoleAccessRule, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, SaveContext, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretKeyDefinition, SecretKeyHandle, SecretMintConfirmStep, SecretMintScreenDefinition, SecretNamespaceDefinition, SecretNamespaceHandle, SecretNamespaceOptions, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, SelectFieldDef, SessionUser, SessionUserOrigin, StreamHandlerDef, StreamHandlerFn, Subscribe, TargetRef, TemplateListVariableDef, TemplateScalarVariableDef, TemplateVariableDef, TemplateVariables, TenantId, TenantWriteTarget, TextFieldDef, ToolbarAction, TranslationEntry, TranslationKeys, TranslationsDef, TranslationValue, TreeAction, TreeActionDef, TreeActionsHandle, TreeChildrenSubscribe, TreeNode, TreeNodeState, UnitKey, UnsafeAppendEventFn, ValidationError, ValidationHookFn, WorkspaceDefinition, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "./types/index.js";
+export type { AccessRule, ActionFormScreenDefinition, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BeforeTransactionPhase, BeforeTransactionResult, BelongsToRelation, BigIntFieldDef, BooleanFieldDef, CamelToKebab, ChatSendFailureCode, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, ConcurrencyMode, ConfigAccessor, ConfigAccessorFactory, ConfigBacking, ConfigCascade, ConfigCascadeLevel, ConfigDefinition, ConfigEditScreenDefinition, ConfigKeyAccess, ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigMask, ConfigResolver, ConfigScope, ConfigSecretsReader, ConfigSeedDef, ConfigStoredRow, ConfigStoredRowWithSource, ConfigValidateContext, ConfigValidateFn, ConfigValue, ConfigValueSource, ConfigValueWithSource, ContentCollectionDefinition, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, CustomScreenDefinition, CustomScreenRoute, DashboardChartPanel, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelVisibility, DashboardProgressListPanel, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextParam, DashboardValueFormat, DateFieldDef, DecimalFieldDef, DeleteContext, DeliveryErrorCode, DeliveryFailureCode, DeliverySkipReason, DeriveContext, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, EditExtensionSection, EditFieldPrefill, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EmbeddedListEditSpec, EntityDefinition, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityId, EntityListExpandableRow, EntityListScreenDefinition, EntityRef, EntityRelations, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, ExtensionOptionsArgs, ExtensionOptionsFor, FeatureDefinition, FeatureRegistrar, FieldAccess, FieldCondition, FieldDefinition, FieldFormatRegistry, FieldIconKey, FieldRenderer, FileFieldDef, FilesFieldDef, Findability, FormatSpec, FormWidth, HandlerContext, HasManyRelation, HookMap, ImageFieldDef, ImagesFieldDef, JobBackoff, JobBackoffStrategy, JobContext, JobDefinition, JobHandlerFn, JobTrigger, JobTriggerEvent, JsonbFieldDef, KumikoEntityTypeMap, KumikoEventTypeMap, KumikoExtensionOptionsMap, KumikoHandlerPayloadMap, KumikoHandlerResultMap, LifecycleHookType, ListColumnSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, LongTextFindability, ManyToManyRelation, MaxPerTenantOptions, MemberReader, MetricNavigate, MetricSpec, MspErrorMode, MspErrorPolicy, MultiSelectFieldDef, MultiStreamApplyFn, MultiStreamProjectionDefinition, NameOrRef, NavDefinition, NavIconKey, NotificationDataFn, NotificationDefinition, NotificationLocalizedTemplate, NotificationRecipientFn, NotificationRecordMapping, NotificationTemplateBody, NotificationTemplateFn, NotificationTemplateMeta, NotifyDeferred, NotifyDelivery, NotifyDeliveryStatus, NotifyDispatched, NotifyFactory, NotifyFn, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, NumberFieldDef, OnDeleteStrategy, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, ParentRefDef, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, PlatformComponent, PluralForms, PostDeleteHookFn, PostSaveHookFn, PreDeleteHookFn, PreparedWriteEvent, PreQueryHookFn, PreSaveHookFn, ProjectionDefinition, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, ProjectionTable, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RateLimitPer, RecordHeaderSpec, RecordHeaderSubtitlePart, ReferenceDataDef, Registry, RelationDefinition, ResolvedPiiFlags, RetentionDef, RoleAccessPersonalData, RoleAccessRule, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, SaveContext, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretKeyDefinition, SecretKeyHandle, SecretMintConfirmStep, SecretMintScreenDefinition, SecretNamespaceDefinition, SecretNamespaceHandle, SecretNamespaceOptions, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, SelectFieldDef, SessionUser, SessionUserOrigin, StreamHandlerDef, StreamHandlerFn, Subscribe, TargetRef, TemplateListVariableDef, TemplateScalarVariableDef, TemplateVariableDef, TemplateVariables, TenantId, TenantWriteTarget, TextFieldDef, ToolbarAction, TranslationEntry, TranslationKeys, TranslationsDef, TranslationValue, TreeAction, TreeActionDef, TreeActionsHandle, TreeChildrenSubscribe, TreeNode, TreeNodeState, UnitKey, UnsafeAppendEventFn, ValidationError, ValidationHookFn, WorkspaceDefinition, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "./types/index.js";
 export { DEFAULT_CURRENCIES, DEFAULT_LOCALES, DELIVERY_FAILURE_CODES, DELIVERY_SKIP_REASONS, HookPhases, HTTP_ERROR_CODE_PATTERN, isAgentVisibleScreen, isDeliveryErrorCode, isOpenToAllGranted, resolveAgentExposure, } from "./types/index.js";
 export type { AwaitedEventType, PipelineBuildCtx, PipelineCtx, PipelineDef, StepBuilder, StepDef, StepFailureStrategy, StepInstance, StepKind, StepNamespace, StepResolver, } from "./types/step.js";
 export { runValidation } from "./validation.js";

package/dist/engine/registry-validate.d.ts

@@ -26,6 +26,7 @@ export declare function resolveJobTriggers(state: RegistryState): void;
 export declare function validateLiveEntities(state: RegistryState): void;
 export declare function validateBootGates(state: RegistryState): void;
 export declare function validateJobBackoff(state: RegistryState): void;
+export declare function validateMaxPerTenant(state: RegistryState): void;
 export declare function validateExtensionUsageTargets(state: RegistryState): void;
 export declare function computeHasRateLimitedHandler(state: RegistryState): void;
 export declare function publishEventPiiCatalog(state: RegistryState): void;

package/dist/engine/registry-validate.js

@@ -1,6 +1,7 @@
 import { configureEventPiiCatalog } from "../crypto/event-pii.js";
 import { hasSearchablePlaintext, isSensitiveLabelField } from "../db/entity-field-encryption.js";
 import { entityEventName } from "../db/event-store-executor-context.js";
+import { resolveMaxPerTenant } from "../jobs/max-per-tenant.js";
 import { bindHookEscapeHatchGrant } from "../pipeline/system-identity-switch.js";
 import { resolveName } from "./handler-helpers.js";
 import { parseRefTargetEntityName } from "./parse-ref-target.js";
@@ -744,6 +745,26 @@ export function validateJobBackoff(state) {
         }
     }
 }
+export function validateMaxPerTenant(state) {
+    for (const [jobName, jobDef] of state.jobMap) {
+        const resolved = resolveMaxPerTenant(jobDef);
+        if (!resolved)
+            continue;
+        if (!Number.isInteger(resolved.limit) || resolved.limit <= 0) {
+            throw new Error(`Job "${jobName}" maxPerTenant limit must be a positive integer (got ${resolved.limit})`);
+        }
+        if (typeof jobDef.maxPerTenant !== "object")
+            continue;
+        const { deferMs } = jobDef.maxPerTenant;
+        if (deferMs !== undefined && (!Number.isInteger(deferMs) || deferMs <= 0)) {
+            throw new Error(`Job "${jobName}" maxPerTenant.deferMs must be a positive integer (got ${deferMs})`);
+        }
+        // The inline boot-gate path has no BullMQ token to move the job to delayed with.
+        if (resolved.onLimit === "defer" && jobDef.bootGate) {
+            throw new Error(`Job "${jobName}" cannot combine bootGate with maxPerTenant onLimit "defer"`);
+        }
+    }
+}
 export function validateExtensionUsageTargets(state) {
     // Validate: extension usages must reference existing extensions
     for (const usage of state.extensionUsages) {

package/dist/engine/registry.js

@@ -3,7 +3,7 @@ import { dedupeFeatures } from "./dedupe-features.js";
 import { buildRegistryFacade } from "./registry-facade.js";
 import { populateClaimsAndAuth, populateConfigKeys, populateEvents, populateExtensionsAndSeeds, populateFeatureCore, populateHandlers, populateHooks, populateJobsAndNotifications, populateMetricsAndSecrets, populateProjectionsAndTables, populateScreensNavWorkspaces, populateSystemEvents, populateTranslations, } from "./registry-ingest.js";
 import { createInitialState } from "./registry-state.js";
-import { applyExtensionUsages, autoWireSoftDeleteJobs, buildEntityEventUpcasterChains, buildEventUpcasterChains, buildImplicitProjections, buildIncomingRelations, buildSearchableSortableCaches, computeHasRateLimitedHandler, finalizeWorkspaceNavMembership, populateHandlerEntityMappings, publishEventPiiCatalog, resolveJobTriggers, resolveNotificationTriggersAndRegisterHooks, validateBootGates, validateEntityHookTargets, validateEventMigrationVersions, validateExtensionSelectors, validateExtensionUsageTargets, validateFieldAccessHandlersAreEntityMapped, validateJobBackoff, validateLifecycleHookTargets, validateLiveEntities, validateNotificationRecordMappings, validateProjectionApplyKeys, validateRelationTargetsExist, validateRequiredFeatures, } from "./registry-validate.js";
+import { applyExtensionUsages, autoWireSoftDeleteJobs, buildEntityEventUpcasterChains, buildEventUpcasterChains, buildImplicitProjections, buildIncomingRelations, buildSearchableSortableCaches, computeHasRateLimitedHandler, finalizeWorkspaceNavMembership, populateHandlerEntityMappings, publishEventPiiCatalog, resolveJobTriggers, resolveNotificationTriggersAndRegisterHooks, validateBootGates, validateEntityHookTargets, validateEventMigrationVersions, validateExtensionSelectors, validateExtensionUsageTargets, validateFieldAccessHandlersAreEntityMapped, validateJobBackoff, validateLifecycleHookTargets, validateLiveEntities, validateMaxPerTenant, validateNotificationRecordMappings, validateProjectionApplyKeys, validateRelationTargetsExist, validateRequiredFeatures, } from "./registry-validate.js";
 // This is where the magic happens. By "magic" I mean: precomputed maps.
 // I build everything once at boot (hooks, relations, searchable fields, ...)
 // so nothing has to iterate over objects at runtime. O(1) instead of O(n*m).
@@ -48,6 +48,7 @@ export function createRegistry(rawFeatures) {
     validateBootGates(state);
     validateLiveEntities(state);
     validateJobBackoff(state);
+    validateMaxPerTenant(state);
     validateExtensionUsageTargets(state);
     computeHasRateLimitedHandler(state);
     publishEventPiiCatalog(state);

package/dist/engine/types/index.d.ts

@@ -1,5 +1,5 @@
 export { isAgentVisibleScreen, resolveAgentExposure, } from "@cosmicdrift/kumiko-types/agent-exposure";
-export type { ConfigAccessor, ConfigAccessorFactory, ConfigBacking, ConfigBounds, ConfigCascade, ConfigCascadeLevel, ConfigComputedContext, ConfigComputedFn, ConfigDefinition, ConfigKeyAccess, ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigMask, ConfigResolver, ConfigSecretsReader, ConfigSeedDef, ConfigStoredRow, ConfigStoredRowWithSource, ConfigValidateContext, ConfigValidateFn, ConfigValue, ConfigValueSource, ConfigValueWithSource, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, ExtensionSelectorDef, ExtensionSelectorPanel, JobBackoff, JobBackoffStrategy, JobDefinition, JobHandlerFn, JobRunIn, JobTrigger, NotificationDataFn, NotificationDefinition, NotificationLocalizedTemplate, NotificationRecipientFn, NotificationRecordMapping, NotificationTemplateBody, NotificationTemplateFn, NotificationTemplateMeta, PluralForms, ReferenceDataDef, RegistrarExtensionDef, RegistrarExtensionHooks, RegistrarExtensionRegistration, RunIn, TemplateListVariableDef, TemplateScalarVariableDef, TemplateVariableDef, TemplateVariables, TranslationEntry, TranslationKeys, TranslationsDef, TranslationValue, UiExtensionDef, } from "@cosmicdrift/kumiko-types/config";
+export type { ConfigAccessor, ConfigAccessorFactory, ConfigBacking, ConfigBounds, ConfigCascade, ConfigCascadeLevel, ConfigComputedContext, ConfigComputedFn, ConfigDefinition, ConfigKeyAccess, ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigMask, ConfigResolver, ConfigSecretsReader, ConfigSeedDef, ConfigStoredRow, ConfigStoredRowWithSource, ConfigValidateContext, ConfigValidateFn, ConfigValue, ConfigValueSource, ConfigValueWithSource, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, ExtensionSelectorDef, ExtensionSelectorPanel, JobBackoff, JobBackoffStrategy, JobDefinition, JobHandlerFn, JobRunIn, JobTrigger, MaxPerTenantOptions, NotificationDataFn, NotificationDefinition, NotificationLocalizedTemplate, NotificationRecipientFn, NotificationRecordMapping, NotificationTemplateBody, NotificationTemplateFn, NotificationTemplateMeta, PluralForms, ReferenceDataDef, RegistrarExtensionDef, RegistrarExtensionHooks, RegistrarExtensionRegistration, RunIn, TemplateListVariableDef, TemplateScalarVariableDef, TemplateVariableDef, TemplateVariables, TranslationEntry, TranslationKeys, TranslationsDef, TranslationValue, UiExtensionDef, } from "@cosmicdrift/kumiko-types/config";
 export type { QueryHandlerDefinition, StreamHandlerDefinition, WriteHandlerDefinition, WriteHandlerInput, } from "@cosmicdrift/kumiko-types/define-handler";
 export type { EntityCrudRegistrar, EntityCrudVerb, EntityHandlerOptions, EntityQueryHandlerOptions, EntityWriteHandlerOptions, RegisterEntityCrudOptions, } from "@cosmicdrift/kumiko-types/entity-handlers";
 export type { KumikoEntityTypeMap, KumikoEventTypeMap, KumikoHandlerPayloadMap, KumikoHandlerResultMap, } from "@cosmicdrift/kumiko-types/event-type-map";

package/dist/jobs/job-runner.d.ts

@@ -20,6 +20,7 @@ export type JobMeta = {
     payload?: string | undefined;
     attempt?: number | undefined;
     priority?: number | undefined;
+    jobId?: string | undefined;
     tenantVisibleRun?: {
         readonly tenantId: string;
         readonly subject: string | null;

package/dist/jobs/job-runner.js

@@ -1,6 +1,6 @@
 import { escapeHatchFor } from "@cosmicdrift/kumiko-types/handlers";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
-import { Queue, UnrecoverableError, Worker } from "bullmq";
+import { DelayedError, Queue, UnrecoverableError, Worker } from "bullmq";
 import { Redis } from "ioredis";
 import { requestContext } from "../api/request-context.js";
 import { createTenantDb, createUncheckedSystemDb } from "../db/tenant-db.js";
@@ -19,6 +19,7 @@ import { createGatedIdentitySwitch } from "../pipeline/system-identity-switch.js
 import { buildPersonalDataGate, isPersonalDataGated, parseWriteOrigin, } from "../pipeline/write-origin.js";
 import { bridgeStub } from "../testing/handler-context.js";
 import { cronRepeatOptions } from "./cron-repeat-options.js";
+import { resolveMaxPerTenant } from "./max-per-tenant.js";
 // Shape-checked after the BullMQ/Redis JSON round-trip. Unlike `_writeOrigin`
 // (a security-relevant escape hatch that must fail the run closed), a
 // malformed `_triggerEvent` only costs an idempotency-key convenience — the
@@ -248,6 +249,9 @@ function tenantFailureMessageKey(err, declaration) {
 // Leading underscore matches the existing internal-meta convention
 // (_triggeredById, _tenantId, _payload).
 const TRACE_CONTEXT_KEY = "_traceContext";
+const DEFER_COUNT_KEY = "_deferCount";
+const DEFER_DELAY_CAP_MS = 30_000;
+const DEFER_BACKOFF_MAX_DOUBLINGS = 5;
 function readTraceContext(data) {
     const raw = data[TRACE_CONTEXT_KEY];
     if (!raw || typeof raw !== "object")
@@ -555,18 +559,23 @@ export function createJobRunner(options) {
     // lane (jobDef.runIn is static), but walking both is cheap and avoids
     // a subtle bug if someone ever reassigns a job to a different lane
     // between deploys while old queue contents are still draining.
-    async function isOverPerTenantLimit(jobName, tenantId, max) {
+    // `activeOnly` + `self` serve the defer check, which runs inside the job being
+    // counted: it must not see waiting jobs or itself, and only counts jobs that
+    // became active before it. Without that order, workers that fetch a burst of
+    // jobs together all see each other as active and all defer, again and again.
+    async function isOverPerTenantLimit(jobName, tenantId, max, scope = {}) {
         const results = await Promise.all([
             queues.api.getActive(),
-            queues.api.getWaiting(),
             queues.worker.getActive(),
-            queues.worker.getWaiting(),
+            ...(scope.activeOnly ? [] : [queues.api.getWaiting(), queues.worker.getWaiting()]),
         ]);
         let count = 0;
         for (const list of results) {
             for (const j of list) {
                 if (j.name !== jobName)
                     continue;
+                if (scope.self && !isActiveBefore(j, scope.self))
+                    continue;
                 const t = j.data?._tenantId; // @cast-boundary dynamic-key
                 if (t === tenantId) {
                     count += 1;
@@ -577,6 +586,22 @@ export function createJobRunner(options) {
         }
         return false;
     }
+    function isActiveBefore(other, self) {
+        if (other.id === self.id)
+            return false;
+        if (self.processedOn === undefined)
+            return true;
+        const otherProcessedOn = other.processedOn ?? 0;
+        if (otherProcessedOn !== self.processedOn)
+            return otherProcessedOn < self.processedOn;
+        return (other.id ?? "") < (self.id ?? "");
+    }
+    // Growing delay bounds Redis and worker load while one tenant has a large
+    // backlog: every deferred job would otherwise be re-checked every deferMs.
+    function deferDelayMs(deferMs, deferCount) {
+        const grown = Math.min(deferMs * 2 ** Math.min(deferCount, DEFER_BACKOFF_MAX_DOUBLINGS), DEFER_DELAY_CAP_MS);
+        return grown + Math.floor(Math.random() * deferMs);
+    }
     // Only err.message, never payload or the logs array: job payloads can carry PII.
     function logFailedAttempt(entry) {
         errorLogger.error("job failed", {
@@ -647,7 +672,7 @@ export function createJobRunner(options) {
             });
         }
     }
-    async function handleJob(bullJob) {
+    async function handleJob(bullJob, token) {
         const rawName = bullJob.name;
         // Handle perTenant dispatch jobs — fan out to one job per tenant. The
         // fan-out re-enqueues into the lane the actual job is assigned to;
@@ -729,6 +754,25 @@ export function createJobRunner(options) {
             await reportPreRunFailure(jobName, bullJob, err);
             throw err;
         }
+        // maxPerTenant defer: checked before anything is recorded for this run, so a
+        // deferred pickup leaves no span, run-log entry or failure trace and does not
+        // consume an attempt (moveToDelayed + DelayedError, not a retry).
+        const maxPerTenant = resolveMaxPerTenant(jobDef);
+        const deferTenantId = bullJob.data["_tenantId"];
+        if (maxPerTenant?.onLimit === "defer" &&
+            typeof deferTenantId === "string" &&
+            token !== undefined &&
+            bullJob.moveToDelayed &&
+            (await isOverPerTenantLimit(jobName, deferTenantId, maxPerTenant.limit, {
+                activeOnly: true,
+                self: { id: bullJob.id, processedOn: bullJob.processedOn },
+            }))) {
+            const priorDeferCount = bullJob.data[DEFER_COUNT_KEY];
+            const deferCount = typeof priorDeferCount === "number" ? priorDeferCount : 0;
+            await bullJob.updateData?.({ ...bullJob.data, [DEFER_COUNT_KEY]: deferCount + 1 });
+            await bullJob.moveToDelayed(Date.now() + deferDelayMs(maxPerTenant.deferMs, deferCount), token);
+            throw new DelayedError();
+        }
         // Sequential gate: try to claim the per-name lock. If another worker
         // (or this worker on a different bullJob) holds it, re-enqueue with a
         // small delay and exit *successfully* — using throw would burn the
@@ -1202,7 +1246,7 @@ export function createJobRunner(options) {
                 return;
             }
             const consumerQueue = queues[consumerLane];
-            worker = new Worker(queueNameFor(queueNamePrefix, consumerLane), handleJob, {
+            worker = new Worker(queueNameFor(queueNamePrefix, consumerLane), (job, token) => handleJob(job, token), {
                 connection: redisOpts,
                 concurrency: 5,
                 // Not consuming until the boot gates passed: a job already queued from a
@@ -1361,10 +1405,11 @@ export function createJobRunner(options) {
             // against; without it the guard is inactive (system jobs, ambient
             // dispatch). Fan-out children of perTenant jobs land here on their
             // recursive queue.add and DO carry _tenantId.
-            if (jobDef.maxPerTenant !== undefined) {
+            const maxPerTenant = resolveMaxPerTenant(jobDef);
+            if (maxPerTenant?.onLimit === "skip") {
                 const tenantId = payload?._tenantId; // @cast-boundary dynamic-key
                 if (tenantId !== undefined &&
-                    (await isOverPerTenantLimit(jobName, tenantId, jobDef.maxPerTenant))) {
+                    (await isOverPerTenantLimit(jobName, tenantId, maxPerTenant.limit))) {
                     return "skipped:max-per-tenant";
                 }
             }
@@ -1406,6 +1451,8 @@ export function createJobRunner(options) {
                 bullOpts["timeout"] = jobDef.timeout;
             if (meta?.priority !== undefined)
                 bullOpts["priority"] = meta.priority;
+            if (meta?.jobId !== undefined)
+                bullOpts["jobId"] = meta.jobId;
             // Pack meta into job data with _ prefix
             const data = { ...payload };
             if (meta?.triggeredById !== undefined)
@@ -1467,8 +1514,9 @@ export function createJobRunner(options) {
                     data["_correlationId"] = reqCtx.correlationId;
                 // Same maxPerTenant guard as dispatch — events that fan into many
                 // jobs must respect the per-tenant cap or the limit is one-sided.
-                if (jobDef.maxPerTenant !== undefined && user?.tenantId !== undefined) {
-                    if (await isOverPerTenantLimit(name, String(user.tenantId), jobDef.maxPerTenant)) {
+                const maxPerTenant = resolveMaxPerTenant(jobDef);
+                if (maxPerTenant?.onLimit === "skip" && user?.tenantId !== undefined) {
+                    if (await isOverPerTenantLimit(name, String(user.tenantId), maxPerTenant.limit)) {
                         continue;
                     }
                 }
@@ -1485,17 +1533,21 @@ export function createJobRunner(options) {
         async countPendingJobs() {
             let total = 0;
             for (const queue of Object.values(queues)) {
-                const counts = await queue.getJobCounts("waiting", "active", "prioritized", "waiting-children");
+                // One getJobCounts call is a single atomic snapshot. Reading delayed in a
+                // second call misses a deferred job that cycles delayed -> active between
+                // the reads, so delayed is counted here and only repeat schedulers (which
+                // stay delayed between cron fires) are subtracted afterwards.
+                const counts = await queue.getJobCounts("waiting", "active", "prioritized", "waiting-children", "delayed");
                 total +=
                     (counts["waiting"] ?? 0) +
                         (counts["active"] ?? 0) +
                         (counts["prioritized"] ?? 0) +
-                        (counts["waiting-children"] ?? 0);
-                // getJobCounts has no id-prefix filter for "delayed" — getJobs(["delayed"])
-                // loads the full Job objects (payload included) just to read .id; fine for
+                        (counts["waiting-children"] ?? 0) +
+                        (counts["delayed"] ?? 0);
+                // getJobs(["delayed"]) loads full Job objects just to read .id; fine for
                 // test-draining's low volume, not a pattern for a prod-path hot loop.
                 const delayed = await queue.getJobs(["delayed"]);
-                total += delayed.filter((job) => !(job.id ?? "").startsWith("repeat:")).length;
+                total -= delayed.filter((job) => (job.id ?? "").startsWith("repeat:")).length;
             }
             return total;
         },

package/dist/jobs/max-per-tenant.d.ts

@@ -0,0 +1,8 @@
+import type { JobDefinition } from "../engine/types/index.js";
+export declare const DEFAULT_MAX_PER_TENANT_DEFER_MS = 1000;
+export type ResolvedMaxPerTenant = {
+    readonly limit: number;
+    readonly onLimit: "skip" | "defer";
+    readonly deferMs: number;
+};
+export declare function resolveMaxPerTenant(jobDef: Pick<JobDefinition, "maxPerTenant">): ResolvedMaxPerTenant | undefined;

package/dist/jobs/max-per-tenant.js

@@ -0,0 +1,14 @@
+export const DEFAULT_MAX_PER_TENANT_DEFER_MS = 1_000;
+export function resolveMaxPerTenant(jobDef) {
+    const raw = jobDef.maxPerTenant;
+    if (raw === undefined)
+        return undefined;
+    if (typeof raw === "number") {
+        return { limit: raw, onLimit: "skip", deferMs: DEFAULT_MAX_PER_TENANT_DEFER_MS };
+    }
+    return {
+        limit: raw.limit,
+        onLimit: raw.onLimit,
+        deferMs: raw.deferMs ?? DEFAULT_MAX_PER_TENANT_DEFER_MS,
+    };
+}

package/dist/pipeline/index.d.ts

@@ -31,6 +31,8 @@ export type { LifecycleHooks, SystemHookDef, SystemHooks } from "./lifecycle-pip
 export { createLifecycleHooks } from "./lifecycle-pipeline.js";
 export type { MspRebuildDeps } from "./msp-rebuild.js";
 export { rebuildMultiStreamProjection } from "./msp-rebuild.js";
+export type { MultiStreamApplyContext, MultiStreamApplyContextDeps, } from "./multi-stream-apply-context.js";
+export { createMultiStreamApplyContext } from "./multi-stream-apply-context.js";
 export { assertNotifyTargetsOwnTenant, createDeferringNotify } from "./notify-scope.js";
 export type { ProjectionProgress, RebuildResult } from "./projection-rebuild.js";
 export { getAllProjectionProgress, getProjectionState, listProjectionsWithState, rebuildProjection, } from "./projection-rebuild.js";

package/dist/pipeline/index.js

@@ -16,6 +16,7 @@ export { createIdempotencyGuard } from "./idempotency.js";
 export { assertInstructionFieldWriteAllowed, assertIrreversibleOperationAllowed, isIrreversibleEntityVerb, } from "./irreversible-operation-gate.js";
 export { createLifecycleHooks } from "./lifecycle-pipeline.js";
 export { rebuildMultiStreamProjection } from "./msp-rebuild.js";
+export { createMultiStreamApplyContext } from "./multi-stream-apply-context.js";
 export { assertNotifyTargetsOwnTenant, createDeferringNotify } from "./notify-scope.js";
 export { getAllProjectionProgress, getProjectionState, listProjectionsWithState, rebuildProjection, } from "./projection-rebuild.js";
 export { createProjectionStateTable, ProjectionStatuses, projectionStateTable, } from "./projection-state.js";

package/dist/pipeline/multi-stream-apply-context.d.ts

@@ -14,5 +14,6 @@ export type MultiStreamApplyContextDeps = {
     readonly files?: FileContext;
     readonly derivatives?: DerivativesContext;
     readonly secrets?: SecretsContext;
+    readonly jobs?: MultiStreamApplyContext["jobs"];
 };
 export declare function createMultiStreamApplyContext(deps: MultiStreamApplyContextDeps): MultiStreamApplyContext;

package/dist/pipeline/multi-stream-apply-context.js

@@ -7,6 +7,7 @@ export function createMultiStreamApplyContext(deps) {
         ...(deps.files ? { files: deps.files } : {}),
         ...(deps.derivatives ? { derivatives: deps.derivatives } : {}),
         ...(deps.secrets ? { secrets: deps.secrets } : {}),
+        ...(deps.jobs ? { jobs: deps.jobs } : {}),
         appendEvent: (async (args) => {
             await appendDomainEventCore({
                 registry: deps.registry,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.365.0",
+  "version": "0.365.1",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -210,8 +210,8 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-http": "0.365.0",
-    "@cosmicdrift/kumiko-types": "0.365.0",
+    "@cosmicdrift/kumiko-http": "0.365.1",
+    "@cosmicdrift/kumiko-types": "0.365.1",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -227,7 +227,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.365.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.365.1",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.365.1",
+    "type": "fix",
+    "title": "App and worker boot wait for Postgres instead of crashing",
+    "detail": "runProdApp and worker processes now probe the database before the schema-drift check and retry with exponential backoff (1s to 15s, up to 90s) on transient connection errors such as too_many_connections or ECONNREFUSED. The KMS health check at boot retries the same way. Non-transient errors like auth failures still abort immediately."
+  },
+  {
+    "version": "0.365.1",
+    "type": "fix",
+    "title": "Restoring a soft-deleted row with a money field no longer fails with a 500",
+    "detail": "restore() wrote the raw stored row (money as bigint minor units) into payload.previous, and the jsonb bind threw. It now builds previous in the same domain form as delete(), so the restored event carries { amount, currency, ... } for money fields."
+  },
+  {
+    "version": "0.365.1",
+    "type": "fix",
+    "title": "version_conflict from delete, restore, forget and update reports the actual stream version",
+    "detail": "After a lost append race, delete, restore and forget returned currentVersion -1 and update returned the version read before the race, so expectedVersion and currentVersion looked equal. They now look up the stream version after the conflict; -1 remains only when that lookup fails."
+  },
   {
     "version": "0.365.0",
     "type": "improvement",