@cosmicdrift/kumiko-framework 0.389.0 → 0.390.0

package/dist/files/file-routes.js

@@ -1,3 +1,4 @@
+import { isUuid } from "@cosmicdrift/kumiko-types/identifiers";
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { Hono } from "hono";
 import { bodyLimit } from "hono/body-limit";
@@ -5,10 +6,12 @@ import { getUser } from "../api/auth-middleware.js";
 import { requestContext } from "../api/request-context.js";
 import { collectPiiSubjectFields, configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, PII_ERASED_SENTINEL, } from "../crypto/index.js";
 import { selectMany } from "../db/query.js";
+import { runInRowLevelSecurityScope, tenantRowLevelSecurityScope, } from "../db/row-level-security-scope.js";
 import { createProjectingTenantDb } from "../db/tenant-db.js";
-import { createDerivativesContext, resolveFieldVariant, resolveRenderer, } from "../derivatives/index.js";
+import { createDerivativesContext, resolveRenderer } from "../derivatives/derivatives-context.js";
+import { resolveFieldVariant } from "../derivatives/index.js";
+import { isFileField } from "../engine/field-helpers.js";
 import { isAnonymousSessionUser, SYSTEM_USER_ID } from "../engine/system-user.js";
-import { isFileField, isUuid, } from "../engine/types/index.js";
 import { createFailOpenReporter, respondRateLimited } from "../rate-limit/middleware.js";
 import { listActionFormFileFields, mayUseActionForm } from "./action-form-upload.js";
 import { buildContentDispositionHeader } from "./content-disposition.js";
@@ -116,6 +119,13 @@ export function createFileRoutes(options) {
     const executor = getFileRefExecutor();
     const piiSubjectFields = collectPiiSubjectFields(fileRefEntity);
     const api = new Hono();
+    // These routes read the file table on the root connection, outside the dispatcher, so the caller's tenant scope is opened here.
+    api.use("*", async (c, next) => {
+        const user = getUser(c);
+        if (user === undefined)
+            return next();
+        return runInRowLevelSecurityScope(tenantRowLevelSecurityScope(user.tenantId), next);
+    });
     const tenantDbFor = (tenantId) => createProjectingTenantDb(db, tenantId, options.registry);
     const fileNameIsPersonal = piiSubjectFields.includes("fileName");
     function kmsContextFor() {

package/dist/files/index.d.ts

@@ -1,25 +1,23 @@
 export { listActionFormFileFields, resolveActionFormFileField } from "./action-form-upload.ts";
-export type { BindPendingFileRefOutcome, PendingFileRef, PendingFileRefBindTarget, } from "./bind-pending-file-refs.ts";
+export type { PendingFileRef } from "./bind-pending-file-refs.ts";
 export { bindPendingFileRef, loadPendingFileRef } from "./bind-pending-file-refs.ts";
-export type { CreatedFileRef, CreateFileRefContext, CreateFileRefInput, UploadedFileBytes, UploadFileBytesContext, } from "./create-file-ref-from-bytes.ts";
+export type { CreatedFileRef, CreateFileRefInput, UploadedFileBytes, } from "./create-file-ref-from-bytes.ts";
 export { createFileRefFromBytes, createFileRefFromUploadedBytes, uploadFileBytesBeforeTransaction, } from "./create-file-ref-from-bytes.ts";
 export { createFilesFeature, FILES_FEATURE } from "./feature.ts";
-export type { FileContext, FileHandle } from "./file-handle.ts";
+export type { FileContext } from "./file-handle.ts";
 export { createFileContext, createTenantFileContext, deriveKey, storageKeyStemPrefix, } from "./file-handle.ts";
 export { FILE_REF_ENTITY_NAME, fileRefEntity } from "./file-ref-entity.ts";
 export { fileRefsTable } from "./file-ref-table.ts";
-export type { FileAccessDecision, FileAccessGuard, FileRef, FileRoutesOptions, } from "./file-routes.ts";
-export { createFileRoutes, readFilesRouteOptions, resolveMaxUploadBodyBytes, } from "./file-routes.ts";
+export type { FileAccessGuard } from "./file-routes.ts";
+export { readFilesRouteOptions, resolveMaxUploadBodyBytes, } from "./file-routes.ts";
 export type { InMemoryFileProvider } from "./in-memory-provider.ts";
 export { createInMemoryFileProvider } from "./in-memory-provider.ts";
 export { createLocalProvider } from "./local-provider.ts";
-export type { FileProviderContext, FileProviderPlugin, FileProviderResolver, FileProviderResolverDeps, } from "./provider-resolver.ts";
-export { createFileProviderForTenant, isFileProviderPlugin, makeFileProviderResolver, } from "./provider-resolver.ts";
-export { resolveContentType } from "./resolve-content-type.ts";
-export { fileRefStorageDelta, filesStorageTrackingFeature, tenantStorageUsageTable, transferTenantStorageUsage, } from "./storage-tracking.ts";
-export { DEFAULT_UPLOAD_SWEEP_GRACE_HOURS, MIN_UPLOAD_SWEEP_GRACE_HOURS, sweepOrphanedUploads, } from "./sweep-orphaned-uploads.ts";
-export type { FileContentValidationResult, FileMetadata, FileStorageProvider, FileValidationOptions, SignedUrlOptions, UploadMimeTypeResolution, WriteStreamOptions, } from "./types.ts";
-export { assertSafeStorageKey, buildStorageKey, normalizeMimeType, parseMaxSize, resolveUploadMimeType, sniffMimeType, tenantExportPrefix, tenantStoragePrefixes, validateFile, validateFileContent, } from "./types.ts";
-export { createFileUploadLedger, fileUploadLedgerTable, withUploadLedger, } from "./upload-ledger.ts";
+export type { FileProviderContext, FileProviderPlugin, FileProviderResolver, } from "./provider-resolver.ts";
+export { createFileProviderForTenant, isFileProviderPlugin, } from "./provider-resolver.ts";
+export { filesStorageTrackingFeature, tenantStorageUsageTable, transferTenantStorageUsage, } from "./storage-tracking.ts";
+export type { FileStorageProvider, SignedUrlOptions, } from "./types.ts";
+export { assertSafeStorageKey, buildStorageKey, normalizeMimeType, sniffMimeType, tenantExportPrefix, tenantStoragePrefixes, validateFile, } from "./types.ts";
+export { fileUploadLedgerTable, withUploadLedger, } from "./upload-ledger.ts";
 export type { ZipEntry } from "./zip-stream.ts";
 export { createZipStream } from "./zip-stream.ts";

package/dist/files/index.js

@@ -7,13 +7,11 @@ export { createFilesFeature, FILES_FEATURE } from "./feature.js";
 export { createFileContext, createTenantFileContext, deriveKey, storageKeyStemPrefix, } from "./file-handle.js";
 export { FILE_REF_ENTITY_NAME, fileRefEntity } from "./file-ref-entity.js";
 export { fileRefsTable } from "./file-ref-table.js";
-export { createFileRoutes, readFilesRouteOptions, resolveMaxUploadBodyBytes, } from "./file-routes.js";
+export { readFilesRouteOptions, resolveMaxUploadBodyBytes, } from "./file-routes.js";
 export { createInMemoryFileProvider } from "./in-memory-provider.js";
 export { createLocalProvider } from "./local-provider.js";
-export { createFileProviderForTenant, isFileProviderPlugin, makeFileProviderResolver, } from "./provider-resolver.js";
-export { resolveContentType } from "./resolve-content-type.js";
-export { fileRefStorageDelta, filesStorageTrackingFeature, tenantStorageUsageTable, transferTenantStorageUsage, } from "./storage-tracking.js";
-export { DEFAULT_UPLOAD_SWEEP_GRACE_HOURS, MIN_UPLOAD_SWEEP_GRACE_HOURS, sweepOrphanedUploads, } from "./sweep-orphaned-uploads.js";
-export { assertSafeStorageKey, buildStorageKey, normalizeMimeType, parseMaxSize, resolveUploadMimeType, sniffMimeType, tenantExportPrefix, tenantStoragePrefixes, validateFile, validateFileContent, } from "./types.js";
-export { createFileUploadLedger, fileUploadLedgerTable, withUploadLedger, } from "./upload-ledger.js";
+export { createFileProviderForTenant, isFileProviderPlugin, } from "./provider-resolver.js";
+export { filesStorageTrackingFeature, tenantStorageUsageTable, transferTenantStorageUsage, } from "./storage-tracking.js";
+export { assertSafeStorageKey, buildStorageKey, normalizeMimeType, sniffMimeType, tenantExportPrefix, tenantStoragePrefixes, validateFile, } from "./types.js";
+export { fileUploadLedgerTable, withUploadLedger, } from "./upload-ledger.js";
 export { createZipStream } from "./zip-stream.js";

package/dist/files/load-save-file-refs.d.ts

@@ -1,5 +1,6 @@
+import type { SaveContext } from "@cosmicdrift/kumiko-types/hooks";
 import type { TenantDb } from "../db/tenant-db.ts";
-import { type Registry, type SaveContext, type SessionUser } from "../engine/types/index.ts";
+import type { Registry, SessionUser } from "../engine/types/index.ts";
 export type FileRefRows = ReadonlyMap<string, Readonly<Record<string, unknown>>>;
 export declare function loadSaveFileRefs(args: {
     readonly registry: Registry;

package/dist/files/load-save-file-refs.js

@@ -1,6 +1,6 @@
 import { selectMany } from "../db/query.js";
 import { tenantDbRunner } from "../db/tenant-db-runner.js";
-import { isFileField, } from "../engine/types/index.js";
+import { isFileField } from "../engine/field-helpers.js";
 import { getStreamVersions } from "../event-store/event-store.js";
 import { fileRefIdsOf } from "./bind-pending-file-refs.js";
 import { FILE_REF_ENTITY_NAME } from "./file-ref-entity.js";

package/dist/files/provider-resolver.d.ts

@@ -1,8 +1,9 @@
 import type { CacheSyncBus } from "@cosmicdrift/kumiko-types/cache-sync-types";
+import type { ConfigAccessor, ConfigAccessorFactory } from "@cosmicdrift/kumiko-types/config";
 import type { FileProviderResolver } from "@cosmicdrift/kumiko-types/file-provider-resolver-types";
 import type { DbConnection } from "../db/connection.ts";
 import type { TenantDb } from "../db/tenant-db.ts";
-import type { ConfigAccessor, ConfigAccessorFactory, Registry } from "../engine/types/index.ts";
+import type { Registry } from "../engine/types/index.ts";
 import type { SecretsContext } from "../secrets/index.ts";
 import type { FileStorageProvider } from "./types.ts";
 /**
@@ -28,7 +29,7 @@ import type { FileStorageProvider } from "./types.ts";
 export type FileProviderContext = {
     readonly config?: ConfigAccessor;
     readonly registry?: Registry;
-    readonly secrets?: SecretsContext;
+    readonly secrets: SecretsContext | undefined;
     readonly auditUserId?: string | undefined;
 };
 /**
@@ -38,7 +39,7 @@ export type FileProviderContext = {
  *
  * **Plugin-Author-Warning:** `ctx` is EXPLICITLY a FileProviderContext, not
  * a full HandlerContext. Fields outside the narrow surface (e.g.
- * `ctx.tx`, `ctx.actor`, `ctx.signal`) are NOT available on the worker path.
+ * `ctx.tx`, `ctx.actor`, `ctx.lifecycle.signal`) are NOT available on the worker path.
  * Casting `ctx as unknown as HandlerContext` fails at runtime on the worker —
  * the crash only appears in production with the first S3 tenant. If a plugin
  * needs fields outside FileProviderContext, extend FileProviderContext
@@ -52,7 +53,7 @@ export declare function createFileProviderForTenant(ctx: FileProviderContext, te
 export type { FileProviderResolver } from "@cosmicdrift/kumiko-types/file-provider-resolver-types";
 export type FileProviderResolverDeps = {
     readonly registry?: Registry;
-    readonly _configAccessorFactory?: ConfigAccessorFactory;
+    readonly configAccessorFactory?: ConfigAccessorFactory;
     readonly secrets?: SecretsContext;
     readonly db?: DbConnection | TenantDb;
     readonly cacheSync?: CacheSyncBus;

package/dist/files/provider-resolver.js

@@ -1,5 +1,5 @@
 // File-provider resolution — lives in the framework so the upload routes,
-// `ctx.files`, AND the GDPR export/forget jobs resolve their FileStorageProvider
+// `ctx.services.files`, AND the GDPR export/forget jobs resolve their FileStorageProvider
 // through ONE path. Divergence (uploads writing one store, erasure deleting
 // another) is structurally impossible: there is a single resolver.
 //
@@ -101,11 +101,11 @@ export function makeFileProviderResolver(deps) {
         if (cached)
             return cached;
         const built = (async () => {
-            if (!deps.registry || !deps._configAccessorFactory || !deps.db) {
-                throw new Error("makeFileProviderResolver: registry/_configAccessorFactory/db missing — " +
+            if (!deps.registry || !deps.configAccessorFactory || !deps.db) {
+                throw new Error("makeFileProviderResolver: registry/configAccessorFactory/db missing — " +
                     "mount the config + file-foundation features and wire context.db");
             }
-            const config = deps._configAccessorFactory({
+            const config = deps.configAccessorFactory({
                 user: { id: SYSTEM_USER_ID, tenantId },
                 db: deps.db,
                 secrets: deps.secrets,

package/dist/files/storage-tracking.js

@@ -11,11 +11,13 @@
 // consumer-cursor row. Apps that want it pass filesStorageTrackingFeature
 // into createApp / setupTestStack alongside their domain features.
 import { bigint, instant, integer, table as pgTable, sql, uuid } from "../db/dialect.js";
-import { entityEventName, executeRawQueryRead } from "../db/index.js";
+import { entityEventName } from "../db/index.js";
 import { toPostgresArrayLiteral } from "../db/queries/postgres-array-literal.js";
+import { executeRawQueryRead } from "../db/queries/raw-sql.js";
 import { incrementCounter } from "../db/query.js";
 import { defineFeature, qn, toKebab } from "../engine/index.js";
-import { SHARED_INSTANCE_SENTINEL, selectConsumerCursorForUpdate, } from "../pipeline/index.js";
+import { selectConsumerCursorForUpdate } from "../pipeline/event-dispatcher-delivery.js";
+import { SHARED_INSTANCE_SENTINEL } from "../pipeline/index.js";
 import { parseJsonOrThrow } from "../utils/index.js";
 const FILE_REF_AGGREGATE_TYPE = "fileRef";
 const STORAGE_TRACKING_FEATURE_NAME = "files-storage-tracking";

package/dist/files/sweep-orphaned-uploads.d.ts

@@ -1,6 +1,6 @@
 import type { FileContext } from "@cosmicdrift/kumiko-types/file-handle-types";
 import type { Logger } from "@cosmicdrift/kumiko-types/logger";
-import { type TenantDb } from "../db/tenant-db.ts";
+import type { TenantDb } from "../db/tenant-db.ts";
 export declare const ORPHANED_UPLOAD_SWEEP_BATCH = 500;
 export declare const DEFAULT_UPLOAD_SWEEP_GRACE_HOURS = 24;
 export declare const MIN_UPLOAD_SWEEP_GRACE_HOURS = 1;

package/dist/files/sweep-orphaned-uploads.js

@@ -1,5 +1,5 @@
 import { selectMany } from "../db/query.js";
-import { runInOwnTransaction } from "../db/tenant-db.js";
+import { runInOwnTransaction } from "../db/tenant-db-scoped-rebind.js";
 import { deleteFileRefBytes } from "../derivatives/delete-stored-file.js";
 import { fileRefsTable } from "./file-ref-table.js";
 import { fileUploadLedgerTable, takeUploadLedgerEntry } from "./upload-ledger.js";

package/dist/i18n/index.d.ts

@@ -1,12 +1,6 @@
 import type { Registry } from "../engine/types/index.ts";
+import type { I18n, I18nOptions } from "./internals.ts";
 export { hasMailTranslationKey, hasMailTranslations, listMailLocales, mailT, registerMailTranslations, resolveMailLocale, } from "./mail-registry.ts";
-export { canonicalizeLocaleTag, DEFAULT_LOCALE, isValidLocaleTag, pickAcceptLanguage, rankAcceptLanguage, rankPreferredLocales, resolveHeaderLocale, } from "./request-locale.ts";
+export { canonicalizeLocaleTag, isValidLocaleTag, rankPreferredLocales, } from "./request-locale.ts";
 export { SETTINGS_HUB_I18N } from "./settings-hub-keys.ts";
-export type I18nOptions = {
-    defaultLocale: string;
-};
-export type I18n = {
-    t(key: string, locale?: string, params?: Readonly<Record<string, unknown>>): string;
-    getAllKeys(): string[];
-};
 export declare function createI18n(registry: Registry, options: I18nOptions): I18n;

package/dist/i18n/index.js

@@ -1,6 +1,6 @@
 import { resolveTranslationValue } from "../ui-types/plural.js";
 export { hasMailTranslationKey, hasMailTranslations, listMailLocales, mailT, registerMailTranslations, resolveMailLocale, } from "./mail-registry.js";
-export { canonicalizeLocaleTag, DEFAULT_LOCALE, isValidLocaleTag, pickAcceptLanguage, rankAcceptLanguage, rankPreferredLocales, resolveHeaderLocale, } from "./request-locale.js";
+export { canonicalizeLocaleTag, isValidLocaleTag, rankPreferredLocales, } from "./request-locale.js";
 export { SETTINGS_HUB_I18N } from "./settings-hub-keys.js";
 export function createI18n(registry, options) {
     const translations = registry.getAllTranslations();

package/dist/i18n/internals.d.ts

@@ -0,0 +1,7 @@
+export type I18nOptions = {
+    defaultLocale: string;
+};
+export type I18n = {
+    t(key: string, locale?: string, params?: Readonly<Record<string, unknown>>): string;
+    getAllKeys(): string[];
+};

package/dist/i18n/internals.js

@@ -0,0 +1 @@
+export {};

package/dist/i18n/required-surface-keys.d.ts

@@ -1,4 +1,7 @@
-import type { FeatureDefinition, NavDefinition, ScreenDefinition, WorkspaceDefinition } from "../engine/types/index.ts";
+import type { NavDefinition } from "@cosmicdrift/kumiko-types/nav";
+import type { ScreenDefinition } from "@cosmicdrift/kumiko-types/screen";
+import type { WorkspaceDefinition } from "@cosmicdrift/kumiko-types/workspace";
+import type { FeatureDefinition } from "../engine/types/index.ts";
 /** Pseudo-entity for actionForm field labels (renderer action-form-shim). */
 export declare const ACTION_FORM_ENTITY = "__action-form__";
 /** Pseudo-entity for configEdit field labels (renderer config-edit-shim). */

package/dist/internal/row-level-security.d.ts

@@ -0,0 +1,3 @@
+export { isRowLevelSecurityViolation } from "../db/pg-error.ts";
+export { DEFAULT_ROW_LEVEL_SECURITY_MODE } from "../db/render-rls-ddl.ts";
+export { appHookScopedRunner, runInRowLevelSecurityScope, runInSystemRowLevelSecurityScope, systemScopedRunner, tenantRowLevelSecurityScope, } from "../db/row-level-security-scope.ts";

package/dist/internal/row-level-security.js

@@ -0,0 +1,3 @@
+export { isRowLevelSecurityViolation } from "../db/pg-error.js";
+export { DEFAULT_ROW_LEVEL_SECURITY_MODE } from "../db/render-rls-ddl.js";
+export { appHookScopedRunner, runInRowLevelSecurityScope, runInSystemRowLevelSecurityScope, systemScopedRunner, tenantRowLevelSecurityScope, } from "../db/row-level-security-scope.js";

package/dist/internal/stack-support.d.ts

@@ -1,6 +1,6 @@
 export { isClosedConnectionError } from "../db/closed-connection.ts";
 export { createDbConnection } from "../db/connection.ts";
-export { acquireSessionAdvisoryLock, createDatabase, databaseExists, dropDatabaseIfExists, listDatabaseNamesWithPrefix, renameDatabase, truncateTablesRestartIdentity, } from "../db/queries/test-stack.ts";
+export { acquireSessionAdvisoryLock, createApplicationRole, createDatabase, databaseExists, dropDatabaseIfExists, listDatabaseNamesWithPrefix, renameDatabase, transferDatabaseOwnership, transferPublicSchemaOwnership, truncateTablesRestartIdentity, } from "../db/queries/test-stack.ts";
 export type { AnyDb } from "../db/query.ts";
 export { columnNamesOf } from "../db/schema-inspection.ts";
 export { schemaTableName } from "../db/table-introspection.ts";

package/dist/internal/stack-support.js

@@ -1,7 +1,7 @@
 // @runtime dev
 export { isClosedConnectionError } from "../db/closed-connection.js";
 export { createDbConnection } from "../db/connection.js";
-export { acquireSessionAdvisoryLock, createDatabase, databaseExists, dropDatabaseIfExists, listDatabaseNamesWithPrefix, renameDatabase, truncateTablesRestartIdentity, } from "../db/queries/test-stack.js";
+export { acquireSessionAdvisoryLock, createApplicationRole, createDatabase, databaseExists, dropDatabaseIfExists, listDatabaseNamesWithPrefix, renameDatabase, transferDatabaseOwnership, transferPublicSchemaOwnership, truncateTablesRestartIdentity, } from "../db/queries/test-stack.js";
 export { columnNamesOf } from "../db/schema-inspection.js";
 export { schemaTableName } from "../db/table-introspection.js";
 export { addMissingColumns, addMissingIndexes, tableToMeta, unsafeCreateEntityTable, unsafeEnsureEntityTable, unsafePushTables, } from "../db/table-push.js";

package/dist/internal/testing.d.ts

@@ -6,6 +6,7 @@ export { resetBlindIndexKeyForTests } from "../crypto/blind-index.ts";
 export { resetEventPiiCatalogForTests } from "../crypto/event-pii.ts";
 export { resetPiiSubjectKmsForTests } from "../crypto/pii-field-encryption.ts";
 export { resetEntityFieldEncryptionCacheForTests } from "../db/entity-field-encryption.ts";
+export { type ExecutorManagedEntitySource, executorManagedEntitySourceOf, } from "../db/executor-managed-tables.ts";
 export declare function withExecutorManagedWritesForTests(db: TenantDb): ExecutorManagedTenantDb;
 export declare function withExecutorManagedWritesForTests(db: DbRunner): ExecutorManagedRunner;
 export declare function withExecutorManagedWritesForTests(db: AnyDb): ExecutorManagedTenantDb | ExecutorManagedRunner;

package/dist/internal/testing.js

@@ -4,13 +4,17 @@ export { resetBlindIndexKeyForTests } from "../crypto/blind-index.js";
 export { resetEventPiiCatalogForTests } from "../crypto/event-pii.js";
 export { resetPiiSubjectKmsForTests } from "../crypto/pii-field-encryption.js";
 export { resetEntityFieldEncryptionCacheForTests } from "../db/entity-field-encryption.js";
+export { executorManagedEntitySourceOf, } from "../db/executor-managed-tables.js";
 export function withExecutorManagedWritesForTests(db) {
     if (isBoundTenantDb(db)) {
-        return createTenantDb({
-            db: withExecutorManagedWrites(tenantDbRunner(db)),
-            tenantId: db.tenantId,
-            mode: db.mode,
-        });
+        const options = { db: withExecutorManagedWrites(tenantDbRunner(db)), tenantId: db.tenantId };
+        return db.mode === "system"
+            ? createTenantDb({
+                ...options,
+                mode: "system",
+                reason: "test seeding mirrors a system-mode TenantDb",
+            })
+            : createTenantDb(options);
     }
     if (isDbRunner(db))
         return withExecutorManagedWrites(db);

package/dist/jobs/index.d.ts

@@ -1,2 +1,2 @@
-export type { JobDroppedMeta, JobLogEntry, JobMeta, JobOutcomeMeta, JobQueuedMeta, JobRunner, JobRunnerOptions, JobSubjectValue, } from "./job-runner.ts";
+export type { JobDroppedMeta, JobLogEntry, JobMeta, JobOutcomeMeta, JobQueuedMeta, JobRunner, JobRunnerOptions, } from "./job-runner.ts";
 export { createJobRunner, serializeJobSubject } from "./job-runner.ts";

package/dist/jobs/job-append-event.d.ts

@@ -0,0 +1,12 @@
+import type { AppendEventFn } from "@cosmicdrift/kumiko-types/handlers";
+import type { TenantDb } from "../db/tenant-db.ts";
+import type { Registry, SessionUser } from "../engine/types/index.ts";
+type JobAppendEventInput = {
+    readonly registry: Registry;
+    readonly jobDb: TenantDb | undefined;
+    readonly tenantId: string;
+    readonly systemUser: SessionUser;
+    readonly jobName: string;
+};
+export declare function createJobAppendEvent(input: JobAppendEventInput): AppendEventFn;
+export {};

package/dist/jobs/job-append-event.js

@@ -0,0 +1,30 @@
+import { tenantDbWriteRunner } from "../db/tenant-db-runner.js";
+import { runInOwnTransaction } from "../db/tenant-db-scoped-rebind.js";
+import { InternalError } from "../errors/index.js";
+import { appendDomainEventCore } from "../pipeline/append-event-core.js";
+import { asTypedAppendEventFn } from "../pipeline/typed-append-event.js";
+const CALL_SITE_LABEL = "job ctx.events.append";
+export function createJobAppendEvent(input) {
+    const { registry, jobDb, tenantId, systemUser, jobName } = input;
+    return asTypedAppendEventFn(async (args) => {
+        if (jobDb === undefined) {
+            throw new InternalError({
+                message: `Job ${jobName}: ctx.events.append needs a tenant db`,
+            });
+        }
+        const callerFeature = registry.getJobFeature(jobName);
+        if (callerFeature === undefined) {
+            throw new InternalError({
+                message: `Job ${jobName}: ctx.events.append needs an owning feature, none is registered for this job`,
+            });
+        }
+        await runInOwnTransaction(jobDb, (txDb) => appendDomainEventCore({
+            registry,
+            db: tenantDbWriteRunner(txDb, CALL_SITE_LABEL),
+            tenantId,
+            userId: String(systemUser.id),
+            callSiteLabel: CALL_SITE_LABEL,
+            callerFeature,
+        }, args));
+    });
+}

package/dist/jobs/job-runner-context.d.ts

@@ -1,8 +1,8 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
-import type { ConfigAccessor } from "@cosmicdrift/kumiko-types/config";
+import type { ConfigAccessor, JobDefinition } from "@cosmicdrift/kumiko-types/config";
 import type { WriteOrigin } from "@cosmicdrift/kumiko-types/event-store-types";
+import type { JobContext } from "@cosmicdrift/kumiko-types/handlers";
 import type { DbRow } from "../db/connection.ts";
-import type { JobContext, JobDefinition } from "../engine/types/index.ts";
 import type { JobRunnerScope } from "./job-runner-scope.ts";
 import type { JobInvocation, JobLogEntry, JobMeta } from "./job-runner-types.ts";
 export type TenantVisibleSubjects = {

package/dist/jobs/job-runner-context.js

@@ -6,11 +6,14 @@ import { createDerivativesContext } from "../derivatives/derivatives-context.js"
 import { createSystemUser } from "../engine/system-user.js";
 import { InternalError } from "../errors/index.js";
 import { createTenantFileContext } from "../files/file-handle.js";
-import { createEscapeHatchReporter, createMetricsForFactory } from "../observability/index.js";
+import { createEscapeHatchReporter } from "../observability/escape-hatch-report.js";
+import { createMetricsForFactory } from "../observability/index.js";
 import { configAccessorFactoryOf } from "../pipeline/config-accessor-factory.js";
+import { buildContextServices } from "../pipeline/context-services.js";
 import { createGatedIdentitySwitch } from "../pipeline/system-identity-switch.js";
 import { buildPersonalDataGate, parseWriteOrigin } from "../pipeline/write-origin.js";
-import { attemptNumberOf, createJobLogger, handlerPayloadOf, isFinalAttempt, isJobTriggerEvent, jobSubjectKey, missingDbProxy, tenantIdOfJobData, } from "./job-runner-helpers.js";
+import { createJobAppendEvent } from "./job-append-event.js";
+import { attemptNumberOf, createJobLogger, handlerPayloadOf, hasDeferBudgetLeft, isFinalAttempt, isJobTriggerEvent, jobSubjectKey, missingDbProxy, tenantIdOfJobData, } from "./job-runner-helpers.js";
 // Tenant-visible failure record (JobDefinition.tenantVisibleFailure). The
 // subject is read from the handler payload, so it is resolved where the
 // payload is built, not in the callbacks.
@@ -72,7 +75,7 @@ function buildJobDbFacets(scope, facetInput) {
     const { jobDef, tenantId, writeOrigin } = input;
     const personalDataGate = writeOrigin ? buildPersonalDataGate(registry, writeOrigin) : undefined;
     const configDb = context.db; // @cast-boundary db-operator
-    // Shared by the config accessor and ctx.derivatives below — both need the
+    // Shared by the config accessor and ctx.services.derivatives below — both need the
     // same tenant-scoped db, and building it twice would let the two calls
     // drift apart. Always "system" mode regardless of the job's own
     // systemScope() status (pre-existing, not something this change alters)
@@ -85,6 +88,7 @@ function buildJobDbFacets(scope, facetInput) {
             db: configDb,
             tenantId,
             mode: "system",
+            reason: "job context db for cross-tenant jobs, ctx.systemDb exposure is gated by isSystemJob",
             grants: {
                 projectionRegistry: registry,
                 ...(personalDataGate && { personalDataGate }),
@@ -120,12 +124,12 @@ function buildJobServiceFacets(scope, facetInput, tenantScopedDb) {
     const { context, registry } = scope;
     const { input, systemUser } = facetInput;
     const { tenantId } = input;
-    // Mirror dispatch-shared.ts buildHandlerContext: ctx.files must resolve
+    // Mirror dispatch-shared.ts buildHandlerContext: ctx.services.files must resolve
     // through the same _fileProviderResolver for jobs as for write-handlers,
-    // otherwise event-triggered jobs silently get an unresolved ctx.files.
+    // otherwise event-triggered jobs silently get an unresolved ctx.services.files.
     const fileResolver = context._fileProviderResolver;
     const files = fileResolver ? createTenantFileContext(fileResolver, tenantId) : context.files;
-    // Same buildHandlerContext parity as ctx.files above: ctx.notify/ctx.config
+    // Same buildHandlerContext parity as ctx.services.files above: ctx.notify/ctx.config
     // must resolve for jobs the same way they do for write-handlers, or an
     // app-author job calling ctx.notify(...)/ctx.config(...) hits a TypeError
     // at runtime the write-handler path never would.
@@ -138,7 +142,7 @@ function buildJobServiceFacets(scope, facetInput, tenantScopedDb) {
             secrets: context.secrets,
         })
         : undefined;
-    // Mirror dispatch-shared.ts: ctx.derivatives needs files+db, same
+    // Mirror dispatch-shared.ts: ctx.services.derivatives needs files+db, same
     // tenant-scoped db the config accessor above uses.
     const derivatives = files && tenantScopedDb
         ? createDerivativesContext({ files, registry, db: tenantScopedDb, tenantId })
@@ -190,6 +194,24 @@ function createJobDefer(jobName, bullJob, token) {
         return { kind: "job-deferral", delayMs };
     };
 }
+function buildJobServices(scope, parts) {
+    const { files, derivatives, selfRunner } = parts;
+    return buildContextServices(scope.context, {
+        ...(files && { files }),
+        ...(derivatives && { derivatives }),
+        // Expose the runner so handlers can chain a follow-up job. Symmetric with
+        // how the command-dispatcher hands write-handlers their jobRunner.
+        ...(selfRunner !== undefined && { jobRunner: selfRunner }),
+    });
+}
+function buildJobObservability(scope, log) {
+    const { meter } = scope.context;
+    return {
+        log,
+        metricsFor: createMetricsForFactory(meter),
+        ...(meter && { meter }),
+    };
+}
 function buildJobContext(scope, input) {
     const { jobName, bullJob, token, rawData, tenantId, triggeredById, attempt, finalAttempt } = input;
     const systemUser = createSystemUser(tenantId);
@@ -212,12 +234,24 @@ function buildJobContext(scope, input) {
     // this run (see createJobTriggerEventConsumer).
     const rawTriggerEvent = rawData["_triggerEvent"];
     const triggerEvent = isJobTriggerEvent(rawTriggerEvent) ? rawTriggerEvent : undefined;
+    const jobLogger = createJobLogger(input.logs);
     const jobContext = {
         defer: createJobDefer(jobName, bullJob, token),
-        ...scope.context,
+        canDefer: token !== undefined &&
+            bullJob.moveToDelayed !== undefined &&
+            hasDeferBudgetLeft(rawData, input.jobDef.maxDefers),
         db: jobDb ?? missingDbProxy(jobName),
-        files,
-        derivatives,
+        events: {
+            append: createJobAppendEvent({
+                registry: scope.registry,
+                jobDb,
+                tenantId,
+                systemUser,
+                jobName,
+            }),
+        },
+        services: buildJobServices(scope, { files, derivatives, selfRunner }),
+        lifecycle: scope.context.signal ? { signal: scope.context.signal } : {},
         ...(notify !== undefined && { notify }),
         ...(config !== undefined && { config }),
         ...(systemDb && { systemDb }),
@@ -226,18 +260,14 @@ function buildJobContext(scope, input) {
         // workers can reach projections/jobs without the app author duplicating
         // it into `context` (the JobContext contract guarantees `registry`).
         registry: scope.registry,
-        // Expose the runner so handlers can chain a follow-up job. Symmetric with
-        // how the command-dispatcher hands write-handlers their jobRunner.
-        ...(selfRunner !== undefined && { jobRunner: selfRunner }),
         systemUser,
         triggeredBy: triggeredById !== null ? { id: triggeredById, tenantId } : null,
         attempt,
         finalAttempt,
-        log: createJobLogger(input.logs),
-        metricsFor: createMetricsForFactory(scope.context.meter),
+        obs: buildJobObservability(scope, jobLogger),
         ...(triggerName !== undefined && { triggerName }),
         ...(triggerEvent !== undefined && { triggerEvent }),
-        ...dispatchFacets,
+        dispatch: dispatchFacets,
     };
     return { jobContext, config };
 }

package/dist/jobs/job-runner-execution.d.ts

@@ -1,5 +1,5 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
-import type { JobDeferral } from "../engine/types/index.ts";
+import type { JobDeferral } from "@cosmicdrift/kumiko-types/handlers";
 import type { JobRun } from "./job-runner-context.ts";
 import { type JobRunnerScope } from "./job-runner-scope.ts";
 import type { JobInvocation } from "./job-runner-types.ts";

package/dist/jobs/job-runner-execution.js

@@ -1,11 +1,13 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
 import { UnrecoverableError } from "bullmq";
 import { requestContext } from "../api/request-context.js";
+import { runInSystemRowLevelSecurityScope } from "../db/row-level-security-scope.js";
 import { qnScope } from "../engine/qualified-name.js";
 import { InternalError } from "../errors/index.js";
 import { scrubLogText } from "../logging/index.js";
-import { emitJobLastSuccess, withEscapeHatchAuditScope } from "../observability/index.js";
-import { DEFAULT_MAX_DEFERS, HANDLER_DEFER_COUNT_KEY, isJobDeferral, priorDeferCountOf, readTraceContext, resolveJobTz, tenantFailureMessageKey, } from "./job-runner-helpers.js";
+import { withEscapeHatchAuditScope } from "../observability/escape-hatch-report.js";
+import { emitJobLastSuccess } from "../observability/standard-metrics.js";
+import { DEFAULT_MAX_DEFERS, HANDLER_DEFER_COUNT_KEY, hasDeferBudgetLeft, isJobDeferral, priorDeferCountOf, readTraceContext, resolveJobTz, tenantFailureMessageKey, } from "./job-runner-helpers.js";
 import { laneForJob, logFailedAttempt } from "./job-runner-scope.js";
 function buildOutcomeMeta(run, messageKey, unrecoverable = false) {
     const { jobDef, subjects } = run;
@@ -48,7 +50,7 @@ async function runJobHandler(scope, run, correlation) {
 }
 function assertDeferBudget(run) {
     const maxDefers = run.jobDef.maxDefers ?? DEFAULT_MAX_DEFERS;
-    if (priorDeferCountOf(run.rawData, HANDLER_DEFER_COUNT_KEY) >= maxDefers) {
+    if (!hasDeferBudgetLeft(run.rawData, run.jobDef.maxDefers)) {
         // The counter never resets, so a retry would hit the cap again.
         throw new UnrecoverableError(`Job "${run.jobName}" was deferred ${maxDefers} times (maxDefers); giving up.`);
     }
@@ -135,7 +137,7 @@ export async function executeJobInSpan(scope, run) {
                 : {}),
         },
         ...(parentContext ? { parent: parentContext } : {}),
-    }, () => runAndRecordJob(scope, run, { requestId, correlationId })));
+    }, () => runInSystemRowLevelSecurityScope("job execution span reads job rows of every tenant", () => runAndRecordJob(scope, run, { requestId, correlationId }))));
 }
 export async function applyHandlerDeferral(scope, run, bullJob, deferral, token) {
     if (!deferral || token === undefined || !bullJob.moveToDelayed)

package/dist/jobs/job-runner-gates.d.ts

@@ -1,5 +1,5 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
-import type { JobDefinition } from "../engine/types/index.ts";
+import type { JobDefinition } from "@cosmicdrift/kumiko-types/config";
 import { type JobRun } from "./job-runner-context.ts";
 import { type JobRunnerScope } from "./job-runner-scope.ts";
 import type { JobInvocation } from "./job-runner-types.ts";

package/dist/jobs/job-runner-gates.js

@@ -1,4 +1,3 @@
-/// <reference types="temporal-polyfill/global" preserve="true" />
 import { prepareJobRun } from "./job-runner-context.js";
 import { attemptNumberOf, buildRetryBullOpts, DEFER_COUNT_KEY, deferDelayMs, isFinalAttempt, priorAttemptsOf, priorDeferCountOf, } from "./job-runner-helpers.js";
 import { ACTIVE_TENANT_IDS_QUERY_NAME, perTenantChildJobId } from "./job-runner-schedulers.js";