@cosmicdrift/kumiko-samples 0.362.0 → 0.364.0

package/packages/bundled-features/src/form-draft/db/queries/cleanup.ts

@@ -29,21 +29,21 @@ export async function selectStaleDraftsBatch(
   olderThanDays: number,
   batchSize: number,
 ): Promise<readonly StaleDraftRow[]> {
-  const rows = (await unsafeReadRetrying(
-    db,
-    `SELECT "id", "tenant_id", "owner_id", "draft_key", "draft", "inserted_at" FROM "read_form_drafts"
-     WHERE COALESCE("modified_at", "inserted_at") < now() - ($1::int * interval '1 day')
-     ORDER BY COALESCE("modified_at", "inserted_at") ASC
-     LIMIT $2`,
-    [olderThanDays, batchSize],
-  )) as readonly {
+  const rows = await unsafeReadRetrying<{
     id: string;
     tenant_id: string;
     owner_id: string;
     draft_key: string;
     draft: FormDraftBlob;
     inserted_at: Date;
-  }[];
+  }>(
+    db,
+    `SELECT "id", "tenant_id", "owner_id", "draft_key", "draft", "inserted_at" FROM "read_form_drafts"
+     WHERE COALESCE("modified_at", "inserted_at") < now() - ($1::int * interval '1 day')
+     ORDER BY COALESCE("modified_at", "inserted_at") ASC
+     LIMIT $2`,
+    [olderThanDays, batchSize],
+  );
   return rows.map((row) => ({
     id: row.id,
     tenantId: row.tenant_id as TenantId, // @cast-boundary db-row
@@ -61,7 +61,7 @@ export async function isDraftStillStale(
   id: string,
   olderThanDays: number,
 ): Promise<boolean> {
-  const rows = (await unsafeReadRetrying(
+  const rows = await unsafeReadRetrying<unknown>(
     db,
     `SELECT 1 FROM "read_form_drafts"
      WHERE "id" = $1
@@ -69,6 +69,6 @@ export async function isDraftStillStale(
        AND COALESCE("modified_at", "inserted_at") < now() - ($3::int * interval '1 day')
      LIMIT 1`,
     [id, tenantId, olderThanDays],
-  )) as readonly unknown[];
+  );
   return rows.length > 0;
 }

package/packages/bundled-features/src/form-draft/db/queries/draft-count.ts

@@ -11,11 +11,11 @@ export async function countDraftsByOwner(
   tenantId: TenantId,
   ownerId: string,
 ): Promise<number> {
-  const rows = (await unsafeReadRetrying(
+  const rows = await unsafeReadRetrying<{ count: number }>(
     db,
     `SELECT count(*)::int AS "count" FROM "read_form_drafts"
      WHERE "tenant_id" = $1 AND "owner_id" = $2`,
     [tenantId, ownerId],
-  )) as readonly { count: number }[];
+  );
   return rows[0]?.count ?? 0;
 }

package/packages/bundled-features/src/form-draft/db/queries/owned-file-refs.ts

@@ -62,13 +62,13 @@ export async function filterOwnedFileRefs(
   isCreateMode: boolean,
 ): Promise<readonly OwnedFileRef[]> {
   if (candidateKeys.length === 0) return [];
-  const rows = (await unsafeReadRetrying(
+  const rows = await unsafeReadRetrying<{ id: string; storage_key: string }>(
     db,
     `SELECT "id", "storage_key" FROM "file_refs"
      WHERE "tenant_id" = $1 AND "inserted_by_id" = $2
        AND "storage_key" = ANY($3::text[]) AND "is_deleted" = false
        AND ($5::boolean OR "inserted_at" > $4::timestamptz)`,
     [tenantId, ownerId, candidateKeys, draftInsertedAt.toString(), isCreateMode],
-  )) as readonly { id: string; storage_key: string }[];
+  );
   return rows.map((row) => ({ id: row.id, storageKey: row.storage_key }));
 }

package/packages/bundled-features/src/form-draft/release-file-refs.ts

@@ -1,3 +1,4 @@
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import type { FormDraftBlob } from "./schemas.js";
 
 // The draft blob's `values` is free-form by design (issue #1889: form-draft
@@ -8,8 +9,8 @@ import type { FormDraftBlob } from "./schemas.js";
 // step writes into the draft, whether under a single "file" field or nested
 // in a "files"/"images" array.
 function isFileRefPointer(value: unknown): value is { readonly storageKey: string } {
-  if (typeof value !== "object" || value === null) return false;
-  const storageKey = (value as { storageKey?: unknown }).storageKey;
+  if (!isPlainObject(value)) return false;
+  const storageKey = value["storageKey"];
   return typeof storageKey === "string" && storageKey.length > 0;
 }
 

package/packages/bundled-features/src/inbound-mail-foundation/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Watch supervisor skips and logs accounts whose address does not decrypt",
+    "detail": "Previously a single such account made the whole account snapshot throw."
+  },
   {
     "version": "0.340.0",
     "type": "improvement",

package/packages/bundled-features/src/inbound-mail-foundation/handlers/connect-account.write.ts

@@ -95,7 +95,7 @@ export const connectAccountHandler: WriteHandlerDef = {
       authMethod: payload.authMethod,
       ownerUserId,
       displayName: payload.displayName,
-      address: encryptedFields["address"] as string,
+      address: encryptedFields.address,
       // active ab Connect — der Supervisor greift den Account beim
       // nächsten Tick auf und degradiert ihn bei Credential-Fehlern.
       status: InboundMailAccountStatuses.active,

package/packages/bundled-features/src/inbound-mail-foundation/handlers/ingest-message.write.ts

@@ -199,11 +199,11 @@ export const ingestMessageHandler: WriteHandlerDef = {
       ownerUserId: payload.ownerUserId,
       messageIdHeader: effectiveMessageIdHeader,
       threadKey,
-      from: encryptedMessageFields["from"] as string,
-      to: encryptedMessageFields["to"] as string,
-      cc: encryptedMessageFields["cc"] as string,
-      subject: encryptedMessageFields["subject"] as string,
-      snippet: encryptedMessageFields["snippet"] as string,
+      from: encryptedMessageFields.from,
+      to: encryptedMessageFields.to,
+      cc: encryptedMessageFields.cc,
+      subject: encryptedMessageFields.subject,
+      snippet: encryptedMessageFields.snippet,
       receivedAtIso: payload.receivedAtIso,
       bodyRef: payload.bodyRef,
       scope: payload.scope,
@@ -296,7 +296,7 @@ export const ingestMessageHandler: WriteHandlerDef = {
 
       const threadEventPayload: MailThreadEventPayload = {
         threadKey,
-        subject: encryptedThreadFields["subject"] as string,
+        subject: encryptedThreadFields.subject,
         lastMessageAtIso: newLastAt,
         messageCount,
       };

package/packages/bundled-features/src/inbound-mail-foundation/handlers/list-accounts.query.ts

@@ -34,7 +34,7 @@ export const listAccountsQuery: QueryHandlerDef = {
     if (!piiKms) return { rows };
     const decryptedRows = await Promise.all(
       rows.map((row) =>
-        decryptPiiFieldValues(row as Record<string, unknown>, MAIL_ACCOUNT_PII_FIELDS, piiKms, {
+        decryptPiiFieldValues(row, MAIL_ACCOUNT_PII_FIELDS, piiKms, {
           requestId: `inbound-mail-foundation:list-accounts:${ctx.user.tenantId}`,
         }),
       ),

package/packages/bundled-features/src/inbound-mail-foundation/handlers/list-messages.query.ts

@@ -49,7 +49,7 @@ export const listMessagesQuery: QueryHandlerDef = {
     if (!piiKms) return { rows };
     const decryptedRows = await Promise.all(
       rows.map((row) =>
-        decryptPiiFieldValues(row as Record<string, unknown>, INBOUND_MESSAGE_PII_FIELDS, piiKms, {
+        decryptPiiFieldValues(row, INBOUND_MESSAGE_PII_FIELDS, piiKms, {
           requestId: `inbound-mail-foundation:list-messages:${ctx.user.tenantId}`,
         }),
       ),

package/packages/bundled-features/src/inbound-mail-foundation/handlers/scope-visibility.ts

@@ -4,10 +4,10 @@
 // für read_mail_accounts und read_inbound_messages (Scope-Vererbung).
 
 export function isVisibleToCaller(
-  row: unknown,
+  row: Readonly<Record<string, unknown>>,
   user: { readonly id: string; readonly roles: readonly string[] },
 ): boolean {
-  const owner = (row as Record<string, unknown>)["ownerUserId"];
+  const owner = row["ownerUserId"];
   if (owner == null || owner === "") return true;
   if (owner === user.id) return true;
   return user.roles.includes("TenantAdmin") || user.roles.includes("SystemAdmin");

package/packages/bundled-features/src/inbound-mail-foundation/oauth-access-token.ts

@@ -140,14 +140,17 @@ export function createOAuthAccessTokenManager(
     const secretKey = inboundCredentialSecretKey(account.id);
     return transaction(deps.db, async (tx) => {
       await acquireNamespacedAdvisoryLock(tx, OAUTH_REFRESH_LOCK_NAMESPACE, lockKey(account));
-      const stored = await deps.secrets.get(account.tenantId, secretKey);
+      // Secret read/write join the lock transaction: a second pool connection per refresh
+      // would exhaust a small pool when many accounts refresh at once.
+      const secrets = deps.secrets.withRunner(tx);
+      const stored = await secrets.get(account.tenantId, secretKey);
       if (!stored) {
         throw new InboundAuthError("no refresh token stored for account");
       }
       const currentRefreshToken = stored.reveal();
       const tokens = await refreshWithTimeout(plugin, account, currentRefreshToken);
       if (tokens.refreshToken && tokens.refreshToken !== currentRefreshToken) {
-        await deps.secrets.set(
+        await secrets.set(
           account.tenantId,
           secretKey,
           tokens.refreshToken,
@@ -180,12 +183,14 @@ export function createOAuthAccessTokenManager(
     async storeRefreshToken(account, refreshToken) {
       await transaction(deps.db, async (tx) => {
         await acquireNamespacedAdvisoryLock(tx, OAUTH_REFRESH_LOCK_NAMESPACE, lockKey(account));
-        await deps.secrets.set(
-          account.tenantId,
-          inboundCredentialSecretKey(account.id),
-          refreshToken,
-          inboundRefreshTokenSecretOptions(account.id),
-        );
+        await deps.secrets
+          .withRunner(tx)
+          .set(
+            account.tenantId,
+            inboundCredentialSecretKey(account.id),
+            refreshToken,
+            inboundRefreshTokenSecretOptions(account.id),
+          );
       });
       cache.delete(account.id);
     },

package/packages/bundled-features/src/inbound-mail-foundation/oauth-state.ts

@@ -12,6 +12,7 @@
 
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 
 const STATE_PURPOSE = "inbound-mail-oauth-connect";
 
@@ -91,13 +92,12 @@ export function verifyOAuthState(
 }
 
 function isOAuthStatePayload(v: unknown): v is OAuthStatePayload {
-  if (typeof v !== "object" || v === null) return false;
-  const o = v as Record<string, unknown>;
+  if (!isPlainObject(v)) return false;
   return (
-    typeof o["tenantId"] === "string" &&
-    (o["ownerUserId"] === null || typeof o["ownerUserId"] === "string") &&
-    typeof o["providerKey"] === "string" &&
-    typeof o["mailbox"] === "string" &&
-    typeof o["nonce"] === "string"
+    typeof v["tenantId"] === "string" &&
+    (v["ownerUserId"] === null || typeof v["ownerUserId"] === "string") &&
+    typeof v["providerKey"] === "string" &&
+    typeof v["mailbox"] === "string" &&
+    typeof v["nonce"] === "string"
   );
 }

package/packages/bundled-features/src/inbound-mail-foundation/retention-sweep.ts

@@ -157,12 +157,8 @@ async function purgeExpiredSeenAnchors(
   // direkt tenant-scoped, kein Account-Join. Trifft auch Anker, deren Account
   // schon disconnected/geloescht ist.
   const where = { tenantId, seenAt: { lt: cutoff } };
-  const expired = await selectMany<{ accountId: string }>(
-    db,
-    seenMessageTable as EntityTableMeta,
-    where,
-  );
+  const expired = await selectMany<{ accountId: string }>(db, seenMessageTable, where);
   if (expired.length === 0) return 0;
-  await deleteMany(db, seenMessageTable as EntityTableMeta, where);
+  await deleteMany(db, seenMessageTable, where);
   return expired.length;
 }

package/packages/bundled-features/src/inbound-mail-foundation/tenant-destroy-hook.ts

@@ -62,27 +62,19 @@ async function archiveAndDeleteRows(
 export async function mailAccountTenantDestroyHook(ctx: TenantDataHookCtx): Promise<void> {
   const accountIds = await archiveAndDeleteRows(
     ctx,
-    mailAccountsProjectionTable as EntityTableMeta,
+    mailAccountsProjectionTable,
     MAIL_ACCOUNT_AGGREGATE_TYPE,
   );
   for (const accountId of accountIds) {
-    await ctx.db.deleteMany(syncCursorTable as EntityTableMeta, { accountId });
-    await ctx.db.deleteMany(seenMessageTable as EntityTableMeta, { accountId });
+    await ctx.db.deleteMany(syncCursorTable, { accountId });
+    await ctx.db.deleteMany(seenMessageTable, { accountId });
   }
 }
 
 export async function inboundMessageTenantDestroyHook(ctx: TenantDataHookCtx): Promise<void> {
-  await archiveAndDeleteRows(
-    ctx,
-    inboundMessagesProjectionTable as EntityTableMeta,
-    INBOUND_MESSAGE_AGGREGATE_TYPE,
-  );
+  await archiveAndDeleteRows(ctx, inboundMessagesProjectionTable, INBOUND_MESSAGE_AGGREGATE_TYPE);
 }
 
 export async function mailThreadTenantDestroyHook(ctx: TenantDataHookCtx): Promise<void> {
-  await archiveAndDeleteRows(
-    ctx,
-    mailThreadsProjectionTable as EntityTableMeta,
-    MAIL_THREAD_AGGREGATE_TYPE,
-  );
+  await archiveAndDeleteRows(ctx, mailThreadsProjectionTable, MAIL_THREAD_AGGREGATE_TYPE);
 }

package/packages/bundled-features/src/inbound-mail-foundation/types.ts

@@ -257,17 +257,15 @@ export class InboundTransientError extends Error {
   }
 }
 
-type KindCarrier = { readonly kind?: unknown };
-
 export function isInboundAuthError(e: unknown): e is InboundAuthError {
-  return e instanceof Error && (e as KindCarrier).kind === "inbound-auth-error";
+  return e instanceof Error && "kind" in e && e.kind === "inbound-auth-error";
 }
 export function isInboundRateLimitError(e: unknown): e is InboundRateLimitError {
-  return e instanceof Error && (e as KindCarrier).kind === "inbound-rate-limit-error";
+  return e instanceof Error && "kind" in e && e.kind === "inbound-rate-limit-error";
 }
 export function isInboundCursorInvalidError(e: unknown): e is InboundCursorInvalidError {
-  return e instanceof Error && (e as KindCarrier).kind === "inbound-cursor-invalid-error";
+  return e instanceof Error && "kind" in e && e.kind === "inbound-cursor-invalid-error";
 }
 export function isInboundTransientError(e: unknown): e is InboundTransientError {
-  return e instanceof Error && (e as KindCarrier).kind === "inbound-transient-error";
+  return e instanceof Error && "kind" in e && e.kind === "inbound-transient-error";
 }

package/packages/bundled-features/src/inbound-mail-foundation/watch-supervisor.ts

@@ -49,9 +49,10 @@ import {
   configuredPiiSubjectKms,
   decryptPiiFieldValues,
 } from "@cosmicdrift/kumiko-framework/crypto";
-import type { DbConnection, EntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { DistributedLock } from "@cosmicdrift/kumiko-framework/pipeline";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { InboundMailAccountStatuses, InboundMailFoundationHandlers } from "./constants.js";
 import { MAIL_ACCOUNT_PII_FIELDS, syncCursorTable } from "./entities.js";
 import {
@@ -158,6 +159,17 @@ export type InboundMailSupervisor = {
   readonly stop: () => Promise<void>;
 };
 
+type ActiveMailAccountRow = {
+  readonly id: string;
+  readonly tenantId: string;
+  readonly provider: string;
+  readonly authMethod: string;
+  readonly ownerUserId?: string | null;
+  readonly address: string;
+  readonly displayName?: string;
+  readonly watchState?: string;
+};
+
 export function createInboundMailSupervisor(
   deps: InboundMailSupervisorDeps,
 ): InboundMailSupervisor {
@@ -206,30 +218,34 @@ export function createInboundMailSupervisor(
   // (Provider arbeiten nie mit Ciphertext).
   // ---------------------------------------------------------------
   async function listActiveAccounts(): Promise<readonly MailAccountRecord[]> {
-    const rows = await selectMany(deps.db, mailAccountsProjectionTable, {
+    const rows = await selectMany<ActiveMailAccountRow>(deps.db, mailAccountsProjectionTable, {
       status: InboundMailAccountStatuses.active,
     });
     const piiKms = configuredPiiSubjectKms();
     const records: MailAccountRecord[] = [];
-    for (const raw of rows) {
-      const row = piiKms
-        ? await decryptPiiFieldValues(
-            raw as Record<string, unknown>,
-            MAIL_ACCOUNT_PII_FIELDS,
-            piiKms,
-            { requestId: "inbound-mail-foundation:supervisor:list-accounts" },
-          )
-        : (raw as Record<string, unknown>);
+    for (const row of rows) {
+      const decrypted = piiKms
+        ? await decryptPiiFieldValues(row, MAIL_ACCOUNT_PII_FIELDS, piiKms, {
+            requestId: "inbound-mail-foundation:supervisor:list-accounts",
+          })
+        : row;
+      const decryptedAddress = decrypted["address"];
+      // Falling back to row.address would hand the ciphertext to a provider.
+      // One undecryptable account must not stop polling of every other tenant's accounts.
+      if (typeof decryptedAddress !== "string") {
+        log(`inbound-mail: account ${row.id} skipped — address did not decrypt to text`);
+        continue;
+      }
       records.push({
-        id: row["id"] as string,
-        tenantId: row["tenantId"] as string,
-        provider: row["provider"] as string,
-        authMethod: row["authMethod"] as string,
-        ownerUserId: (row["ownerUserId"] as string | null | undefined) ?? null,
-        address: row["address"] as string,
-        displayName: (row["displayName"] as string | undefined) ?? "",
+        id: row.id,
+        tenantId: row.tenantId,
+        provider: row.provider,
+        authMethod: row.authMethod,
+        ownerUserId: row.ownerUserId ?? null,
+        address: decryptedAddress,
+        displayName: row.displayName ?? "",
         status: InboundMailAccountStatuses.active,
-        watchState: (row["watchState"] as string | undefined) ?? "idle",
+        watchState: row.watchState ?? "idle",
       });
     }
     return records;
@@ -239,13 +255,14 @@ export function createInboundMailSupervisor(
   // Cursor-Persistenz (unmanaged direct-write store).
   // ---------------------------------------------------------------
   async function loadCursor(accountId: string): Promise<SyncCursorPayload | null> {
-    const row = await fetchOne<{ cursor: string }>(deps.db, syncCursorTable as EntityTableMeta, {
+    const row = await fetchOne<{ cursor: string }>(deps.db, syncCursorTable, {
       accountId,
       scope: CURSOR_SCOPE,
     });
     if (!row) return null;
     try {
-      return JSON.parse(row.cursor) as SyncCursorPayload; // @cast-boundary eigene JSON-Persistenz
+      const parsed: unknown = JSON.parse(row.cursor);
+      return isPlainObject(parsed) ? parsed : null;
     } catch {
       return null; // korrupter Cursor = wie kein Cursor → Backfill, Dedup fängt Dubletten
     }
@@ -258,21 +275,21 @@ export function createInboundMailSupervisor(
     const accountId = account.id;
     const now = Temporal.Now.instant().toString();
     const serialized = JSON.stringify(cursor);
-    const existing = await fetchOne<{ id: string }>(deps.db, syncCursorTable as EntityTableMeta, {
+    const existing = await fetchOne<{ id: string }>(deps.db, syncCursorTable, {
       accountId,
       scope: CURSOR_SCOPE,
     });
     if (existing) {
       await updateMany(
         deps.db,
-        syncCursorTable as EntityTableMeta,
+        syncCursorTable,
         { cursor: serialized, updatedAt: now },
         { accountId, scope: CURSOR_SCOPE },
       );
       // skip: update-Pfad fertig — nicht in den insert-Zweig durchfallen.
       return;
     }
-    await insertOne(deps.db, syncCursorTable as EntityTableMeta, {
+    await insertOne(deps.db, syncCursorTable, {
       id: crypto.randomUUID(),
       // Direct-write store: no executor stamps the NOT NULL tenant_id for us.
       tenantId: account.tenantId,
@@ -288,7 +305,7 @@ export function createInboundMailSupervisor(
     // → nächster fetch läuft als Backfill.
     await updateMany(
       deps.db,
-      syncCursorTable as EntityTableMeta,
+      syncCursorTable,
       { cursor: "", updatedAt: Temporal.Now.instant().toString() },
       { accountId, scope: CURSOR_SCOPE },
     );

package/packages/bundled-features/src/inbound-provider-imap/imap-client.ts

@@ -18,6 +18,7 @@ import {
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { legacyDateToInstant } from "@cosmicdrift/kumiko-framework/time";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { ImapFlow } from "imapflow";
 import { type AddressObject, type ParsedMail, simpleParser } from "mailparser";
 import type { ImapCredentialDocument } from "./credential-document.js";
@@ -97,11 +98,11 @@ export function mapImapError(err: unknown, host: string): Error {
   // imapflow-Fehler tragen die Server-Antwort in responseText, die
   // message ist nur "Command failed" — beides in den Match einbeziehen;
   // authenticationFailed ist das verlässliche Flag.
-  const carrier = err as { authenticationFailed?: unknown; responseText?: unknown };
-  const responseText = typeof carrier?.responseText === "string" ? carrier.responseText : "";
+  const carrier = isPlainObject(err) ? err : undefined;
+  const responseText = typeof carrier?.["responseText"] === "string" ? carrier["responseText"] : "";
   const msg = `${err instanceof Error ? err.message : String(err)} ${responseText}`.trim();
   if (
-    carrier?.authenticationFailed === true ||
+    carrier?.["authenticationFailed"] === true ||
     /auth(entication)? failed|invalid credentials|invalid login|LOGIN failed|AUTHENTICATIONFAILED/i.test(
       msg,
     )

package/packages/bundled-features/src/jobs/changes.json

@@ -1,4 +1,23 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "jobs list query caps the page size at 200",
+    "detail": "limit above 200 is rejected with a validation error."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Stale-run sweep uses the job-run retention window for queued runs",
+    "detail": "The sweep now only fails queued runs that are older than the configured retention days instead of every queued run past the stale cutoff, so freshly queued runs of a long backlog are no longer failed."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Tenant-visible job runs no longer collide across tenants, jobs and lanes",
+    "detail": "store_tenant_job_runs was unique on bull_job_id alone, but BullMQ ids count per queue, so a job on the api lane and one on the worker lane (or two tenants after a Redis reset) shared an id and overwrote each other's row. The unique index now covers (tenant_id, job_name, bull_job_id), every write filters by all three, and an enqueue replaces a finished row left over under the same key. onJobDropped now receives { tenantId } as a third argument.",
+    "migration": "Run `kumiko-schema generate` in your app to add the migration that creates store_tenant_job_runs_tenant_job_bull_job_id_unique and drops store_tenant_job_runs_bull_job_id_unique (generated as a commented DROP INDEX; uncomment it). A custom onJobDropped callback passed to the job runner now gets a third argument { tenantId }."
+  },
   {
     "version": "0.360.0",
     "type": "fix",

package/packages/bundled-features/src/jobs/db/queries/stale-run-sweep.ts

@@ -15,6 +15,7 @@
 import { deleteManyBatched, selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { mapWithConcurrency } from "../../../shared/index.js";
+import { DEFAULT_JOB_RUN_RETENTION_DAYS } from "../../handlers/retention-cleanup.job.js";
 import { encryptFailureError } from "../../job-run-logger.js";
 import { jobRunsTable } from "../../job-run-table.js";
 import { tenantJobRunsTable } from "../../tenant-job-run-table.js";
@@ -31,18 +32,24 @@ export type StaleRunSweepResult = {
   readonly tenantQueuedDropped: number;
 };
 
+// A queued tenant row can legitimately wait much longer than a run takes (backlog, delay/backoff,
+// sequential requeue), so it is only treated as lost once it is older than the retention window,
+// not after the running-timeout.
 export async function markStaleJobRunsFailed(
   db: DbConnection,
   timeoutHours: number,
+  queuedRetentionDays: number = DEFAULT_JOB_RUN_RETENTION_DAYS,
 ): Promise<StaleRunSweepResult> {
   const cutoff = Temporal.Now.instant().subtract({ hours: timeoutHours });
+  const queuedCutoff = Temporal.Now.instant().subtract({ hours: queuedRetentionDays * 24 });
   const now = Temporal.Now.instant();
 
   // Fetch the matched rows first: `error` carries the same per-triggering-
   // user subject annotation as job-run-logger.ts's onJobFailed path
   // (personal: { of: "triggeredById" } on job-run-table.ts), so it is encrypted
-  // under that subject's DEK. Runs are grouped by subject: one encrypt and one
-  // updateMany per subject instead of per run.
+  // under the triggering user's DEK, or the system tenant key when
+  // triggeredById is null (whenAbsent: "tenant", fw#3654). Runs are grouped by
+  // that subject: one encrypt and one updateMany per subject instead of per run.
   const stale = await selectMany<{ id: string; triggeredById: string | null }>(db, jobRunsTable, {
     status: "running",
     startedAt: { lt: cutoff },
@@ -86,7 +93,8 @@ export async function markStaleJobRunsFailed(
 
   // Tenant-visible run state follows the same clock: a running row whose
   // worker died is a failure, a queued row that never started (job lost from
-  // Redis, enqueue hook without a run) would otherwise show "waiting" forever.
+  // Redis, enqueue hook without a run) would otherwise show "waiting" forever;
+  // it is dropped once it has outlived the retention window.
   const tenantRunsFailed = await updateMany(
     db,
     tenantJobRunsTable,
@@ -96,7 +104,7 @@ export async function markStaleJobRunsFailed(
   const tenantQueuedStale = await deleteManyBatched(
     db,
     tenantJobRunsTable,
-    { status: "queued", updatedAt: { lt: cutoff } },
+    { status: "queued", updatedAt: { lt: queuedCutoff } },
     { limit: STALE_DELETE_BATCH_SIZE },
   );
 

package/packages/bundled-features/src/jobs/feature.ts

@@ -36,7 +36,8 @@ import { tenantJobRunsTableMeta } from "./tenant-job-run-table.js";
 
 export type JobsFeatureOptions = {
   // How long a job run (and its logs) stays in store_job_runs/
-  // store_job_run_logs before the daily retention-cleanup job deletes it.
+  // store_job_run_logs before the daily retention-cleanup job deletes it. Also the age after
+  // which a tenant-visible "queued" row counts as lost and is dropped by the stale-run sweep.
   readonly retentionDays?: number;
   // How long a run can sit at status "running" before the hourly
   // stale-run-sweep job marks it "failed" (#2246 — a process kill mid-run
@@ -51,7 +52,7 @@ export function createJobsFeature(options: JobsFeatureOptions = {}): FeatureDefi
   const staleRunTimeoutHours = options.staleRunTimeoutHours ?? DEFAULT_JOB_RUN_STALE_TIMEOUT_HOURS;
   return defineFeature("jobs", (r) => {
     r.describe(
-      "Persistence and operator tooling for background jobs registered via `r.job(...)`. Every job execution writes directly into `store_job_runs` (current status + duration) and `store_job_run_logs` (per-line log rows) from the BullMQ callbacks — no event stream in between (#2243). A daily `retention-cleanup` job deletes runs (and their logs) older than `retentionDays`; an hourly `stale-run-sweep` job marks runs stuck at status `running` past `staleRunTimeoutHours` as `failed` (#2246 — a crashed worker never fires the completion callback, so nothing else ever revisits the row). Exposes `jobs:write:trigger` (manual run) and `jobs:write:retry` (operator retry of a failed run), plus `jobs:query:list`, `jobs:query:details`, and `jobs:query:catalog` (manual jobs) for the operator UI. A job that declares `tenantVisibleFailure` also records its last failed attempt per tenant and subject in `store_tenant_job_failures`, which the tenant itself reads through `jobs:query:failures` — a translation key only, never the provider's message (fw#3079). A job that declares `tenantVisibleRun` also keeps its run state per tenant and subject in `store_tenant_job_runs` (queued, running, plus the latest completed or failed run, no payload, error text or logs), which the tenant reads through `jobs:query:tenant-runs` (fw#3616); the stale-run sweep fails its stuck `running` rows and drops its stuck `queued` rows.",
+      "Persistence and operator tooling for background jobs registered via `r.job(...)`. Every job execution writes directly into `store_job_runs` (current status + duration) and `store_job_run_logs` (per-line log rows) from the BullMQ callbacks — no event stream in between (#2243). A daily `retention-cleanup` job deletes runs (and their logs) older than `retentionDays`; an hourly `stale-run-sweep` job marks runs stuck at status `running` past `staleRunTimeoutHours` as `failed` (#2246 — a crashed worker never fires the completion callback, so nothing else ever revisits the row). Exposes `jobs:write:trigger` (manual run) and `jobs:write:retry` (operator retry of a failed run), plus `jobs:query:list`, `jobs:query:details`, and `jobs:query:catalog` (manual jobs) for the operator UI. A job that declares `tenantVisibleFailure` also records its last failed attempt per tenant and subject in `store_tenant_job_failures`, which the tenant itself reads through `jobs:query:failures` — a translation key only, never the provider's message (fw#3079). A job that declares `tenantVisibleRun` also keeps its run state per tenant and subject in `store_tenant_job_runs` (queued, running, plus the latest completed or failed run, no payload, error text or logs), which the tenant reads through `jobs:query:tenant-runs` (fw#3616); the stale-run sweep fails its stuck `running` rows and drops `queued` rows older than `retentionDays`.",
     );
     r.uiHints({
       displayLabel: "Jobs · Audit & Operator UI",
@@ -61,7 +62,9 @@ export function createJobsFeature(options: JobsFeatureOptions = {}): FeatureDefi
     r.systemScope();
     r.storeTable(jobRunsTableMeta, {
       reason: "direct_write.job_runs",
-      // payload/error carry personal:{of:"triggeredById"} (job-run-table.ts).
+      // payload/error carry personal:{of:"triggeredById"} (job-run-table.ts): encrypted under the
+      // triggering user's DEK, or the system tenant key when triggeredById is null
+      // (whenAbsent: "tenant", fw#3654).
       // job-run-logger.ts manually encrypts both before every insert/update
       // (encryptStartedPayload/encryptFailureError) since this store bypasses
       // the executor's automatic PII pipeline (#2243).
@@ -115,7 +118,7 @@ export function createJobsFeature(options: JobsFeatureOptions = {}): FeatureDefi
     r.job(
       "stale-run-sweep",
       { trigger: { cron: "0 * * * *" }, concurrency: "skip" },
-      createStaleRunSweepJob(staleRunTimeoutHours),
+      createStaleRunSweepJob(staleRunTimeoutHours, retentionDays),
     );
 
     const handlers = {

package/packages/bundled-features/src/jobs/handlers/catalog.query.ts

@@ -12,7 +12,7 @@ export type ManualJobCatalogEntry = {
 function payloadSchemaJson(job: JobDefinition): Record<string, unknown> | null {
   if (job.schema === undefined) return null;
   try {
-    return z.toJSONSchema(job.schema) as Record<string, unknown>;
+    return z.toJSONSchema(job.schema);
   } catch {
     // Non-JSON-Schema-able Zod types (transforms/effects) — UI still lists the job.
     return null;

package/packages/bundled-features/src/jobs/handlers/list.query.ts

@@ -8,6 +8,8 @@ import { jobRunsTable } from "../job-run-table.js";
 
 const KMS_POOL_CONCURRENCY = 4;
 const DEFAULT_PAGE_SIZE = 50;
+// The offset cursor re-reads everything up to the page end, so the page size bounds that read.
+const MAX_LIST_LIMIT = 200;
 
 const jobRunStatusSchema = z.enum(["queued", "running", "completed", "failed"]);
 
@@ -68,7 +70,7 @@ export const listQuery = defineQueryHandler({
       .optional(),
     sort: z.enum(["jobName", "status", "startedAt", "duration"]).optional(),
     sortDirection: z.enum(["asc", "desc"]).optional(),
-    limit: z.number().int().min(1).optional(),
+    limit: z.number().int().min(1).max(MAX_LIST_LIMIT).optional(),
     cursor: z.string().optional(),
     totalCount: z.boolean().optional(),
   }),