@cosmicdrift/kumiko-samples 0.387.0 → 0.388.0

package/packages/bundled-features/src/inbound-mail-foundation/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Undecryptable mail account no longer stops polling of other accounts",
+    "detail": "Any decryption failure of an account address (corrupt envelope, missing key, AAD mismatch) is logged by error class and the account is skipped; the other accounts keep polling."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Rename audit reason comes from the caller role",
+    "detail": "update-account records tenant_admin or system_admin from the caller's roles and honors a client-supplied reason only for the system identity, so a form call can no longer write system reasons such as watch_supervisor. The rename form no longer carries a reason field and the reason payload field is optional."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Seen-message lookup handles listings of any size",
+    "detail": "filterUnknownMessageIds queries the already seen provider message ids in chunks of 1000, so a full-mailbox listing no longer exceeds the Postgres bind parameter limit and aborts the account's poll."
+  },
   {
     "version": "0.378.0",
     "type": "fix",

package/packages/bundled-features/src/inbound-mail-foundation/handlers/update-account.write.ts

@@ -3,7 +3,12 @@
 // the account after fixing its credentials. Full-snapshot event: loads the
 // latest state, merges the delta fields, and appends the new snapshot.
 
-import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
+import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
+import {
+  type SessionUser,
+  SYSTEM_USER_ID,
+  type WriteHandlerDef,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { failNotFound, failUnprocessable } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { InboundMailAccountStatuses } from "../constants.ts";
@@ -27,12 +32,19 @@ export const updateAccountSchema = z.object({
   /** Ops-Signal ("idle", "watching", "backoff:3", ...). */
   watchState: z.string().max(100).optional(),
   displayName: z.string().max(200).optional(),
-  /** Audit reason for metadata.headers ("watch_supervisor",
-   *  "oauth_refresh", "tenant_admin"). */
-  reason: z.string().min(1).max(100),
+  /** Audit reason for metadata.headers, honored for the system identity only
+   *  ("watch_supervisor", "oauth_refresh"); user callers get a role-derived reason. */
+  reason: z.string().min(1).max(100).optional(),
 });
 type UpdateAccountPayload = z.infer<typeof updateAccountSchema>;
 
+const SYSTEM_FALLBACK_REASON = "system";
+
+function auditReasonFor(user: SessionUser, requestedReason: string | undefined): string {
+  if (user.id === SYSTEM_USER_ID) return requestedReason ?? SYSTEM_FALLBACK_REASON;
+  return user.roles.includes(ROLES.SystemAdmin) ? "system_admin" : "tenant_admin";
+}
+
 export const updateAccountHandler: WriteHandlerDef = {
   name: "update-account",
   schema: updateAccountSchema,
@@ -65,7 +77,7 @@ export const updateAccountHandler: WriteHandlerDef = {
     };
     const headers: MailAccountEventHeaders = {
       providerName: current.provider,
-      reason: payload.reason,
+      reason: auditReasonFor(event.user, payload.reason),
     };
     await ctx.unsafeAppendEvent({
       aggregateId: payload.accountId,

package/packages/bundled-features/src/inbound-mail-foundation/i18n.ts

@@ -38,5 +38,4 @@ export const INBOUND_MAIL_FOUNDATION_I18N: Readonly<Record<string, { readonly en
   },
   [formFieldKey("accountId")]: { en: "Mailbox" },
   [formFieldKey("displayName")]: { en: "Name" },
-  [formFieldKey("reason")]: { en: "Reason" },
 };

package/packages/bundled-features/src/inbound-mail-foundation/screens.ts

@@ -77,8 +77,6 @@ export const mailAccountListScreen: ProjectionListScreenDefinition = {
   dormant: true,
 };
 
-// The reason is the audit label update-account requires; it is not in the
-// layout, so the default is what gets written.
 export const mailAccountEditScreen: ActionFormScreenDefinition = {
   id: MAIL_ACCOUNT_EDIT_SCREEN_ID,
   type: "actionForm",
@@ -87,7 +85,6 @@ export const mailAccountEditScreen: ActionFormScreenDefinition = {
   fields: {
     accountId: { type: "text", required: true },
     displayName: { type: "text", required: true, maxLength: 200 },
-    reason: { type: "text", default: "tenant_admin" },
   },
   layout: {
     sections: [{ fields: [{ field: "accountId", readOnly: true }, "displayName"] }],

package/packages/bundled-features/src/inbound-mail-foundation/types.ts

@@ -21,8 +21,9 @@ import { INBOUND_MAIL_PROVIDER_EXTENSION, type InboundMailAccountStatus } from "
  *   config   — tenant config reads (host/port/... of the plugins)
  *   registry — extension lookup in the factory (not plugin-internal)
  *   secrets  — tenant secret reads (IMAP password, OAuth refresh token)
- *   auditUserId  — audit identity for secret reads. Handler path: the dispatcher
- *              sets the caller user ID; worker path: system identity.
+ *   auditUserId  — audit identity for secret reads. Handler path: unset,
+ *              requireSecretsContext falls back to ctx.user.id; worker/provider
+ *              path: system identity set by the resolver.
  *   metricsFor — metrics handle of a feature by name, same behavior as
  *              HandlerContext.metricsFor: unregistered metrics are a silent
  *              no-op instead of a throw.
@@ -172,7 +173,7 @@ export type InboundMailProviderPlugin = {
        *  for password accounts and providers without an oauth flow. */
       readonly accessToken?: string;
       /** Batch lookup of the provider message ids not yet ingested for this
-       *  account (committed seen anchors, one query per call). Call it after
+       *  account (committed seen anchors; lists of any size are fine, queried in chunks). Call it after
        *  the listing/delta page and download MIME only for the returned ids.
        *  Ingest dedup stays the correctness anchor; this only saves downloads. */
       readonly filterUnknownMessageIds?: (

package/packages/bundled-features/src/inbound-mail-foundation/watch-supervisor.ts

@@ -88,6 +88,8 @@ const DEFAULT_WATCH_LEASE_TTL_SECONDS = 90;
  *  can add further scopes later without a schema change. */
 const CURSOR_SCOPE = "default";
 
+const SEEN_LOOKUP_CHUNK_SIZE = 1000;
+
 export type InboundMailSupervisorDeps = {
   /** Slim context for provider calls (`registry` is required; `secrets` is
    *  used for provider credential reads). */
@@ -223,11 +225,19 @@ export function createInboundMailSupervisor(
     const piiKms = configuredPiiSubjectKms();
     const records: MailAccountRecord[] = [];
     for (const row of rows) {
-      const decrypted = piiKms
-        ? await decryptPiiFieldValues(row, MAIL_ACCOUNT_PII_FIELDS, piiKms, {
-            requestId: "inbound-mail-foundation:supervisor:list-accounts",
-          })
-        : row;
+      let decrypted: Record<string, unknown>;
+      try {
+        decrypted = piiKms
+          ? await decryptPiiFieldValues(row, MAIL_ACCOUNT_PII_FIELDS, piiKms, {
+              requestId: "inbound-mail-foundation:supervisor:list-accounts",
+            })
+          : row;
+      } catch (error) {
+        // Class name only: the message may carry ciphertext or key details.
+        const errorName = error instanceof Error ? error.name : "unknown error";
+        log(`inbound-mail: account ${row.id} skipped — address did not decrypt (${errorName})`);
+        continue;
+      }
       const decryptedAddress = decrypted["address"];
       // Falling back to row.address would hand the ciphertext to a provider.
       // One undecryptable account must not stop polling of every other tenant's accounts.
@@ -400,17 +410,23 @@ export function createInboundMailSupervisor(
   function unknownMessageIdsFilterFor(account: MailAccountRecord) {
     return async (providerMessageIds: readonly string[]): Promise<ReadonlySet<string>> => {
       if (providerMessageIds.length === 0) return new Set();
-      const seen = await selectMany<{ providerMessageId: string }>(
-        deps.db,
-        seenMessageTable,
-        {
-          tenantId: account.tenantId,
-          accountId: account.id,
-          providerMessageId: { in: providerMessageIds },
-        },
-        { fields: ["providerMessageId"] },
-      );
-      const seenIds = new Set(seen.map((row) => row.providerMessageId));
+      // One bind parameter per id: a full-mailbox listing would exceed Postgres' 65535 limit.
+      const seenIds = new Set<string>();
+      for (let start = 0; start < providerMessageIds.length; start += SEEN_LOOKUP_CHUNK_SIZE) {
+        const seen = await selectMany<{ providerMessageId: string }>(
+          deps.db,
+          seenMessageTable,
+          {
+            tenantId: account.tenantId,
+            accountId: account.id,
+            providerMessageId: {
+              in: providerMessageIds.slice(start, start + SEEN_LOOKUP_CHUNK_SIZE),
+            },
+          },
+          { fields: ["providerMessageId"] },
+        );
+        for (const row of seen) seenIds.add(row.providerMessageId);
+      }
       return new Set(providerMessageIds.filter((id) => !seenIds.has(id)));
     };
   }

package/packages/bundled-features/src/jobs/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "readRoles for tenant job status",
+    "detail": "`createJobsFeature({ readRoles: [\"PropertyManager\"] })` lets those app roles call `jobs:query:failures` and `jobs:query:tenant-runs` for their own tenant. They are added to the default `User`, `Editor` and admin roles, which stay. Before, a member who only holds app roles got access_denied.",
+    "migration": "Optional. Apps whose members hold only their own roles pass `createJobsFeature({ readRoles: [...] })`."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Deduplicated job add keeps the finished tenant run row",
+    "detail": "JobQueuedMeta carries the BullMQ creation time of the job. The queued hook only removes finished rows queued before that time (leftovers of a Redis reset), so re-announcing an already finished job no longer turns its row back into queued."
+  },
   {
     "version": "0.384.0",
     "type": "improvement",

package/packages/bundled-features/src/jobs/feature.ts

@@ -23,8 +23,8 @@ import {
   createStaleRunSweepJob,
   DEFAULT_JOB_RUN_STALE_TIMEOUT_HOURS,
 } from "./handlers/stale-run-sweep.job.ts";
-import { tenantFailuresQuery } from "./handlers/tenant-failures.query.ts";
-import { tenantRunsQuery } from "./handlers/tenant-runs.query.ts";
+import { createTenantFailuresQuery } from "./handlers/tenant-failures.query.ts";
+import { createTenantRunsQuery } from "./handlers/tenant-runs.query.ts";
 import { triggerWrite } from "./handlers/trigger.write.ts";
 import { jobRunLogsTableMeta, jobRunsTableMeta } from "./job-run-table.ts";
 import {
@@ -49,11 +49,21 @@ export type JobsFeatureOptions = {
   // it). Must clear any legitimately long-running job (reindexEntity,
   // projectionRebuild) — set high, not tight.
   readonly staleRunTimeoutHours?: number;
+  // Additional app roles that may read their own tenant's job status and
+  // failures (jobs:query:failures, jobs:query:tenant-runs). Added to the default
+  // User/Editor/admin roles, which stay; the scope stays the caller's own tenant.
+  readonly readRoles?: readonly string[];
 };
 
 export function createJobsFeature(options: JobsFeatureOptions = {}): FeatureDefinition {
   const retentionDays = options.retentionDays ?? DEFAULT_JOB_RUN_RETENTION_DAYS;
   const staleRunTimeoutHours = options.staleRunTimeoutHours ?? DEFAULT_JOB_RUN_STALE_TIMEOUT_HOURS;
+  const readRoles = options.readRoles ?? [];
+  if (readRoles.includes("anonymous")) {
+    throw new Error(
+      `createJobsFeature: readRoles must not contain "anonymous" — job status and failures are only readable by members of the tenant.`,
+    );
+  }
   return defineFeature("jobs", (r) => {
     r.describe(
       "Persistence and operator tooling for background jobs registered via `r.job(...)`. Every job execution writes directly into `store_job_runs` (current status + duration) and `store_job_run_logs` (per-line log rows) from the BullMQ callbacks — no event stream in between (#2243). A daily `retention-cleanup` job deletes runs (and their logs) older than `retentionDays`; an hourly `stale-run-sweep` job marks runs stuck at status `running` past `staleRunTimeoutHours` as `failed` (#2246 — a crashed worker never fires the completion callback, so nothing else ever revisits the row). Exposes `jobs:write:trigger` (manual run) and `jobs:write:retry` (operator retry of a failed run), plus `jobs:query:list`, `jobs:query:details`, and `jobs:query:catalog` (manual jobs) for the operator UI. A job that declares `tenantVisibleFailure` also records its last failed attempt per tenant and subject in `store_tenant_job_failures`, which the tenant itself reads through `jobs:query:failures` — a translation key only, never the provider's message (fw#3079). A job that declares `tenantVisibleRun` also keeps its run state per tenant and subject in `store_tenant_job_runs` (queued, running, plus the latest completed or failed run, no payload, error text or logs), which the tenant reads through `jobs:query:tenant-runs` (fw#3616); the stale-run sweep fails its stuck `running` rows and drops `queued` rows older than `retentionDays`.",
@@ -137,8 +147,8 @@ export function createJobsFeature(options: JobsFeatureOptions = {}): FeatureDefi
       list: r.queryHandler(listQuery),
       detail: r.queryHandler(detailQuery),
       catalog: r.queryHandler(catalogQuery),
-      failures: r.queryHandler(tenantFailuresQuery),
-      tenantRuns: r.queryHandler(tenantRunsQuery),
+      failures: r.queryHandler(createTenantFailuresQuery(readRoles)),
+      tenantRuns: r.queryHandler(createTenantRunsQuery(readRoles)),
       consumers: r.queryHandler(consumersQuery),
       consumerDetails: r.queryHandler(consumerDetailQuery),
     };

package/packages/bundled-features/src/jobs/handlers/tenant-failures.query.ts

@@ -30,44 +30,49 @@ function parseSubject(stored: string | null): Record<string, unknown> | null {
   return Object.fromEntries(parsed.filter(isSubjectEntry));
 }
 
-export const tenantFailuresQuery = defineQueryHandler({
-  name: "failures",
-  description:
-    "Lists the calling tenant's own failed jobs — one record per job and subject, newest first, each carrying a translation key for the reason, never the provider's own error message; the optional subject filter matches exactly: all declared subjectFields with the same JSON types as the job payload; use it to tell a tenant that their asynchronous job failed instead of leaving the screen waiting.",
-  schema: z.object({
-    jobName: z.string().optional(),
-    subject: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).optional(),
-    limit: z.number().int().min(1).max(200).optional(),
-  }),
-  // Every membership rank: a failure record carries a job name and a
-  // translation key, nothing a team member of the tenant may not see.
-  access: { roles: access.roles("User", "Editor", ...access.admin) },
-  handler: async (query, ctx) => {
-    if (!ctx.systemDb) {
-      throw new InternalError({
-        message: "jobs:query:failures requires ctx.systemDb (feature must declare r.systemScope())",
+export function createTenantFailuresQuery(readRoles: readonly string[]) {
+  return defineQueryHandler({
+    name: "failures",
+    description:
+      "Lists the calling tenant's own failed jobs — one record per job and subject, newest first, each carrying a translation key for the reason, never the provider's own error message; the optional subject filter matches exactly: all declared subjectFields with the same JSON types as the job payload; use it to tell a tenant that their asynchronous job failed instead of leaving the screen waiting.",
+    schema: z.object({
+      jobName: z.string().optional(),
+      subject: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).optional(),
+      limit: z.number().int().min(1).max(200).optional(),
+    }),
+    // Every membership rank: a failure record carries a job name and a
+    // translation key, nothing a team member of the tenant may not see.
+    access: {
+      roles: [...new Set([...access.roles("User", "Editor", ...access.admin), ...readRoles])],
+    },
+    handler: async (query, ctx) => {
+      if (!ctx.systemDb) {
+        throw new InternalError({
+          message:
+            "jobs:query:failures requires ctx.systemDb (feature must declare r.systemScope())",
+        });
+      }
+      // assertTenantMatch is a self-check on the caller and returns the same
+      // unfiltered system-mode db (tenant-db.ts) — the explicit tenantId below
+      // is the filter, assertRowsTenant the second net. There is no
+      // cross-tenant mode here: SystemAdmin reads runs via jobs:query:list.
+      const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
+      const where: Record<string, unknown> = { tenantId: [query.user.tenantId] };
+      if (query.payload.jobName) where["jobName"] = query.payload.jobName;
+      if (query.payload.subject) where["subject"] = serializeJobSubject(query.payload.subject);
+      const rows = await selectMany<TenantJobFailureRow>(db, tenantJobFailuresTable, where, {
+        orderBy: { col: "failedAt", direction: "desc" },
+        limit: query.payload.limit ?? DEFAULT_LIMIT,
       });
-    }
-    // assertTenantMatch is a self-check on the caller and returns the same
-    // unfiltered system-mode db (tenant-db.ts) — the explicit tenantId below
-    // is the filter, assertRowsTenant the second net. There is no
-    // cross-tenant mode here: SystemAdmin reads runs via jobs:query:list.
-    const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
-    const where: Record<string, unknown> = { tenantId: [query.user.tenantId] };
-    if (query.payload.jobName) where["jobName"] = query.payload.jobName;
-    if (query.payload.subject) where["subject"] = serializeJobSubject(query.payload.subject);
-    const rows = await selectMany<TenantJobFailureRow>(db, tenantJobFailuresTable, where, {
-      orderBy: { col: "failedAt", direction: "desc" },
-      limit: query.payload.limit ?? DEFAULT_LIMIT,
-    });
-    return {
-      rows: ctx.systemDb.assertRowsTenant(rows, "tenantId").map((row) => ({
-        jobName: row.jobName,
-        subject: parseSubject(row.subject),
-        messageKey: row.messageKey,
-        failedAt: row.failedAt,
-      })),
-      nextCursor: null,
-    };
-  },
-});
+      return {
+        rows: ctx.systemDb.assertRowsTenant(rows, "tenantId").map((row) => ({
+          jobName: row.jobName,
+          subject: parseSubject(row.subject),
+          messageKey: row.messageKey,
+          failedAt: row.failedAt,
+        })),
+        nextCursor: null,
+      };
+    },
+  });
+}

package/packages/bundled-features/src/jobs/handlers/tenant-runs.query.ts

@@ -32,63 +32,67 @@ function parseSubject(stored: string | null): Record<string, unknown> | null {
   return Object.fromEntries(parsed.filter(isSubjectEntry));
 }
 
-export const tenantRunsQuery = defineQueryHandler({
-  name: "tenant-runs",
-  description:
-    "Lists the calling tenant's own job runs that opted in via tenantVisibleRun — per job and subject every queued or running run plus the latest completed or failed one, active runs first, then newest first; each row carries only status and queuedAt/startedAt/finishedAt, never payloads, error text or logs; the optional subject filter matches exactly: all declared subjectFields with the same JSON types as the job payload; use it to show whether work for a subject is waiting, running or done, and to tell a failed run from a finished one.",
-  schema: z.object({
-    jobName: z.string().optional(),
-    subject: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).optional(),
-    limit: z.number().int().min(1).max(200).optional(),
-  }),
-  // Every membership rank: a run state carries a job name, a status and
-  // times, nothing a team member of the tenant may not see.
-  access: { roles: access.roles("User", "Editor", ...access.admin) },
-  handler: async (query, ctx) => {
-    if (!ctx.systemDb) {
-      throw new InternalError({
-        message:
-          "jobs:query:tenant-runs requires ctx.systemDb (feature must declare r.systemScope())",
+export function createTenantRunsQuery(readRoles: readonly string[]) {
+  return defineQueryHandler({
+    name: "tenant-runs",
+    description:
+      "Lists the calling tenant's own job runs that opted in via tenantVisibleRun — per job and subject every queued or running run plus the latest completed or failed one, active runs first, then newest first; each row carries only status and queuedAt/startedAt/finishedAt, never payloads, error text or logs; the optional subject filter matches exactly: all declared subjectFields with the same JSON types as the job payload; use it to show whether work for a subject is waiting, running or done, and to tell a failed run from a finished one.",
+    schema: z.object({
+      jobName: z.string().optional(),
+      subject: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).optional(),
+      limit: z.number().int().min(1).max(200).optional(),
+    }),
+    // Every membership rank: a run state carries a job name, a status and
+    // times, nothing a team member of the tenant may not see.
+    access: {
+      roles: [...new Set([...access.roles("User", "Editor", ...access.admin), ...readRoles])],
+    },
+    handler: async (query, ctx) => {
+      if (!ctx.systemDb) {
+        throw new InternalError({
+          message:
+            "jobs:query:tenant-runs requires ctx.systemDb (feature must declare r.systemScope())",
+        });
+      }
+      // assertTenantMatch returns the same unfiltered system-mode db — the
+      // explicit tenantId below is the filter, assertRowsTenant the second net.
+      const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
+      const where: Record<string, unknown> = { tenantId: [query.user.tenantId] };
+      if (query.payload.jobName) where["jobName"] = query.payload.jobName;
+      if (query.payload.subject) where["subject"] = serializeJobSubject(query.payload.subject);
+      const limit = query.payload.limit ?? DEFAULT_LIMIT;
+      const newestFirst = { col: "updatedAt", direction: "desc" } as const;
+      const activeRows = await selectMany<TenantJobRunRow>(
+        db,
+        tenantJobRunsTable,
+        { ...where, status: { in: ["queued", "running"] } },
+        { orderBy: newestFirst, limit },
+      );
+      const finishedRows = await selectMany<TenantJobRunRow>(
+        db,
+        tenantJobRunsTable,
+        { ...where, status: { in: ["completed", "failed"] } },
+        { orderBy: newestFirst, limit },
+      );
+      const seenFinishedKeys = new Set<string>();
+      const finishedNewestPerKey = finishedRows.filter((row) => {
+        const key = JSON.stringify([row.jobName, row.subject]);
+        if (seenFinishedKeys.has(key)) return false;
+        seenFinishedKeys.add(key);
+        return true;
       });
-    }
-    // assertTenantMatch returns the same unfiltered system-mode db — the
-    // explicit tenantId below is the filter, assertRowsTenant the second net.
-    const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
-    const where: Record<string, unknown> = { tenantId: [query.user.tenantId] };
-    if (query.payload.jobName) where["jobName"] = query.payload.jobName;
-    if (query.payload.subject) where["subject"] = serializeJobSubject(query.payload.subject);
-    const limit = query.payload.limit ?? DEFAULT_LIMIT;
-    const newestFirst = { col: "updatedAt", direction: "desc" } as const;
-    const activeRows = await selectMany<TenantJobRunRow>(
-      db,
-      tenantJobRunsTable,
-      { ...where, status: { in: ["queued", "running"] } },
-      { orderBy: newestFirst, limit },
-    );
-    const finishedRows = await selectMany<TenantJobRunRow>(
-      db,
-      tenantJobRunsTable,
-      { ...where, status: { in: ["completed", "failed"] } },
-      { orderBy: newestFirst, limit },
-    );
-    const seenFinishedKeys = new Set<string>();
-    const finishedNewestPerKey = finishedRows.filter((row) => {
-      const key = JSON.stringify([row.jobName, row.subject]);
-      if (seenFinishedKeys.has(key)) return false;
-      seenFinishedKeys.add(key);
-      return true;
-    });
-    const activeFirst = [...activeRows, ...finishedNewestPerKey];
-    return {
-      rows: ctx.systemDb.assertRowsTenant(activeFirst.slice(0, limit), "tenantId").map((row) => ({
-        jobName: row.jobName,
-        subject: parseSubject(row.subject),
-        status: row.status,
-        queuedAt: row.queuedAt,
-        startedAt: row.startedAt,
-        finishedAt: row.finishedAt,
-      })),
-      nextCursor: null,
-    };
-  },
-});
+      const activeFirst = [...activeRows, ...finishedNewestPerKey];
+      return {
+        rows: ctx.systemDb.assertRowsTenant(activeFirst.slice(0, limit), "tenantId").map((row) => ({
+          jobName: row.jobName,
+          subject: parseSubject(row.subject),
+          status: row.status,
+          queuedAt: row.queuedAt,
+          startedAt: row.startedAt,
+          finishedAt: row.finishedAt,
+        })),
+        nextCursor: null,
+      };
+    },
+  });
+}

package/packages/bundled-features/src/jobs/job-run-logger.ts

@@ -262,15 +262,16 @@ async function recordTenantRunQueued(
   const now = Temporal.Now.instant();
   await transaction(db, async (tx) => {
     // A finished row under the same id is left over from before a Redis reset
-    // (ids restart at 1), not this job. Only rows that went through this hook
-    // (queuedAt set) qualify: a fast worker can finish before the hook runs,
-    // and that row is this job's own and must stay.
+    // (ids restart at 1), not this job. Only rows queued before this BullMQ job
+    // was created qualify: a fast worker can finish before the hook runs (no
+    // queuedAt), and a deduplicated add of an already finished job re-announces
+    // it with a creation time older than its own row. Both rows must stay.
     await deleteMany(tx, tenantJobRunsTable, {
       tenantId: key.tenantId,
       jobName,
       bullJobId,
       status: { in: ["completed", "failed"] },
-      queuedAt: { gt: Temporal.Instant.fromEpochMilliseconds(0) },
+      queuedAt: { lt: Temporal.Instant.fromEpochMilliseconds(meta.jobCreatedAtMs) },
     });
     // DO NOTHING: a fast worker can report the start before this enqueue hook
     // returns, and a repeated jobId (debounce, fan-out dedup) is the same job.

package/packages/bundled-features/src/legal-pages/README.md

@@ -35,7 +35,7 @@ runProdApp({
   //      decoupling — legal-pages imports no code from template-resolver,
   //      only uses the API via ctx)
   anonymousAccess: { defaultTenantId: SYSTEM_TENANT_ID },
-  extraContext: ({ db }) => ({
+  extraContext: ({ db, registry }) => ({
     templateResolver: createTemplateResolverApi(db, registry),
   }),
 });

package/packages/bundled-features/src/mail-foundation/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Tenant mail transport falls back to the app transport without tenant config",
+    "detail": "tenantMailTransport returns null when the channel context carries no tenant config, instead of throwing on every send, so the channel uses the app transport as documented."
+  },
   {
     "version": "0.378.0",
     "type": "improvement",

package/packages/bundled-features/src/mail-foundation/feature.ts

@@ -75,9 +75,9 @@ export const MAIL_TRANSPORT_EXTENSION = "mailTransport" as const;
  *   config      — tenant config reads (the plugin's host/port/from/...)
  *   registry    — extension lookup in the factory (not plugin-internal)
  *   secrets     — tenant secret reads (smtp.password)
- *   auditUserId — audit identity for secret reads. Handler path: the
- *                 dispatcher sets the caller's user id; worker path: the
- *                 r.job wrap sets a system identity.
+ *   auditUserId — audit identity for secret reads. Handler path: unset,
+ *                 requireSecretsContext falls back to ctx.user.id; worker path:
+ *                 the r.job wrap sets a system identity.
  */
 export type MailTransportContext = {
   readonly config?: ConfigAccessor;
@@ -276,6 +276,8 @@ export type TenantMailTransportScope = {
 export function tenantMailTransport(
   scope: TenantMailTransportScope,
 ): Promise<EmailTransport | null> {
+  // Without a tenant config the provider cannot be read: use the app transport.
+  if (scope.config === undefined) return Promise.resolve(null);
   return createTransportForTenantIfConfigured(
     {
       config: scope.config,

package/packages/bundled-features/src/personal-access-tokens/feature.ts

@@ -36,7 +36,7 @@ const PAT_REVOKE_TRIGGERING_FIELDS = ["passwordHash"] as const;
 
 export type BindPatAutoRevokeOnPasswordChange = (
   revoker: (userId: string) => Promise<number>,
-) => void;
+) => () => void;
 
 // Reads the late-bind setter off a mounted personal-access-tokens feature's
 // exports — run{Prod,Dev}App call this once a concrete db is available,
@@ -169,6 +169,9 @@ export function createPersonalAccessTokensFeature(
     });
     const bindAutoRevokeOnPasswordChange: BindPatAutoRevokeOnPasswordChange = (revoker) => {
       boundAutoRevoke = revoker;
+      return () => {
+        if (boundAutoRevoke === revoker) boundAutoRevoke = undefined;
+      };
     };
 
     const handlers = {

package/packages/bundled-features/src/renderer-pdf/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "renderTablePdf validates the document for direct callers",
+    "detail": "renderTablePdf parses the document against pdfTableDocumentSchema and throws RendererError invalid_payload above the row, column and cell caps. Title, subtitle, meta entries, headers, empty text, footer text and page label now have length caps and meta at most 500 entries."
+  },
   {
     "version": "0.364.0",
     "type": "fix",