@cosmicdrift/kumiko-samples 0.404.0 → 0.405.0

package/packages/bundled-features/src/folders/feature.ts

@@ -25,7 +25,7 @@ import {
   type EntityDefinition,
   type FeatureRegistrar,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { assertNoWhereRuleInOwnershipWrite } from "../shared/index.ts";
+import { assertNoWhereRuleInOwnershipWrite, resolveFeatureAccess } from "../shared/index.ts";
 import { createFolderAssignmentEntity, folderEntity } from "./entity.ts";
 import { createClearFolderHandler } from "./handlers/clear-folder.write.ts";
 import { createDeleteFolderHandler } from "./handlers/delete-folder.write.ts";
@@ -148,12 +148,6 @@ export type FoldersFeatureOptions = {
   readonly parents?: readonly string[];
 };
 
-function resolveAccess(opts: FoldersFeatureOptions): AccessRule {
-  if (opts.access !== undefined) return opts.access;
-  if (opts.roles !== undefined) return { roles: opts.roles };
-  return DEFAULT_FOLDER_ACCESS;
-}
-
 // Options wrapper. Without options returns the module-level singleton (no
 // rebuild). access/roles/toggleable build a fresh feature-definition.
 export function createFoldersFeature(
@@ -177,7 +171,7 @@ export function createFoldersFeature(
         "admissible as a host instead.",
     );
   }
-  const access = resolveAccess(opts);
+  const access = resolveFeatureAccess(opts, DEFAULT_FOLDER_ACCESS);
   return defineFeature(FOLDERS_FEATURE_NAME, (r) =>
     registerFolders(r, access, opts.toggleable, opts.ownership, opts.parents),
   );

package/packages/bundled-features/src/folders/web/folder-manager.tsx

@@ -26,14 +26,10 @@
 // src (node_modules is ignored by default) or these classes never compile. money-
 // horse already does; that scan is a real shipping requirement for any host.
 
-import {
-  useDispatcher,
-  usePrimitives,
-  useQuery,
-  useTranslation,
-} from "@cosmicdrift/kumiko-renderer";
+import { usePrimitives, useQuery, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { ChevronRight, File, Folder, type LucideIcon, Pencil, Plus, Trash2 } from "lucide-react";
 import { type DragEvent, type ReactNode, useEffect, useState } from "react";
+import { useDispatchedWrites } from "../../shared/web/use-dispatched-writes.ts";
 import { FoldersHandlers, FoldersQueries } from "./constants.ts";
 import { buildFolderTree, type FolderNode, type FolderRow } from "./tree.ts";
 
@@ -99,13 +95,15 @@ export function FolderManager({
 }): ReactNode {
   const { Banner, Button, Dialog, Input, Text } = usePrimitives();
   const t = useTranslation();
-  const dispatcher = useDispatcher();
   const catalog = useQuery<FolderListResponse>(FoldersQueries.folderList, {});
   const [pending, setPending] = useState<Pending>(null);
   const [draftName, setDraftName] = useState("");
   const [collapsed, setCollapsed] = useState<ReadonlySet<string>>(loadCollapsed);
-  const [busy, setBusy] = useState(false);
-  const [errorKey, setErrorKey] = useState<string | null>(null);
+  const { busy, setBusy, errorKey, setErrorKey, writeOk, apply } = useDispatchedWrites(async () => {
+    setPending(null);
+    await catalog.refetch();
+    await filing?.onReassigned();
+  });
   const [dragOverKey, setDragOverKey] = useState<string | null>(null);
   const [pendingDelete, setPendingDelete] = useState<FolderNode | null>(null);
 
@@ -177,29 +175,6 @@ export function FolderManager({
     setPending({ mode: "rename", id: folder.id, version: folder.version });
   };
 
-  const apply = async (write: () => Promise<boolean>): Promise<void> => {
-    setBusy(true);
-    setErrorKey(null);
-    try {
-      if (await write()) {
-        setPending(null);
-        await catalog.refetch();
-        await filing?.onReassigned();
-      }
-    } finally {
-      setBusy(false);
-    }
-  };
-
-  const writeOk = async (type: string, payload: Record<string, unknown>): Promise<boolean> => {
-    const result = await dispatcher.write(type, payload);
-    if (!result.isSuccess) {
-      setErrorKey(result.error.i18nKey);
-      return false;
-    }
-    return true;
-  };
-
   const saveDraft = (): void => {
     const name = draftName.trim();
     if (name === "" || pending === null) return;

package/packages/bundled-features/src/folders/web/folder-section.tsx

@@ -18,6 +18,7 @@ import {
   useTranslation,
 } from "@cosmicdrift/kumiko-renderer";
 import { type ReactNode, useState } from "react";
+import { useDispatchedWrites } from "../../shared/web/use-dispatched-writes.ts";
 import { FoldersHandlers, FoldersQueries } from "./constants.ts";
 import { type FolderRow, folderPath } from "./tree.ts";
 
@@ -58,8 +59,10 @@ export function FolderSection({
     { enabled },
   );
   const [newName, setNewName] = useState("");
-  const [busy, setBusy] = useState(false);
-  const [errorKey, setErrorKey] = useState<string | null>(null);
+  const refetch = async (): Promise<void> => {
+    await Promise.all([catalog.refetch(), assignments.refetch()]);
+  };
+  const { busy, errorKey, setErrorKey, writeOk, apply } = useDispatchedWrites(refetch);
 
   if (entityId === null) {
     return (
@@ -95,29 +98,6 @@ export function FolderSection({
     ...folders.map((f) => ({ value: f.id, label: folderPath(folders, f.id) })),
   ];
 
-  const refetch = async (): Promise<void> => {
-    await Promise.all([catalog.refetch(), assignments.refetch()]);
-  };
-
-  const apply = async (write: () => Promise<boolean>): Promise<void> => {
-    setBusy(true);
-    setErrorKey(null);
-    try {
-      if (await write()) await refetch();
-    } finally {
-      setBusy(false);
-    }
-  };
-
-  const writeOk = async (type: string, payload: Record<string, unknown>): Promise<boolean> => {
-    const result = await dispatcher.write(type, payload);
-    if (!result.isSuccess) {
-      setErrorKey(result.error.i18nKey);
-      return false;
-    }
-    return true;
-  };
-
   const onSelect = (next: string): void => {
     if (next === currentFolderId) return;
     void apply(() =>

package/packages/bundled-features/src/form-draft/handlers/save.write.ts

@@ -1,6 +1,7 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { failUnprocessable, type WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { failUnprocessable } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import { isUniqueConstraintFailure } from "../../shared/index.ts";
 import { countDraftsByOwner } from "../db/queries/draft-count.ts";
 import { formDraftExecutor } from "../executor.ts";
 import { lookupDraft } from "../lookup.ts";
@@ -11,6 +12,9 @@ import {
   FORM_DRAFT_UNIQUE_KEY_CONSTRAINT,
 } from "../web/constants.ts";
 
+const SAVE_DRAFT_COUNT_REASON =
+  "COUNT(*) of the caller's own drafts without loading 64KB value blobs";
+
 /**
  * save is an upsert keyed on (tenantId, ownerId, draftKey) — same
  * lookup-then-create|update-with-race-retry idiom as
@@ -20,20 +24,6 @@ import {
  * winner's row, and updates it (with the winner's version) instead of
  * erroring.
  */
-function isDraftKeyConflict(failure: WriteFailure): boolean {
-  const error = failure.error as {
-    code?: string;
-    details?: { constraintName?: string };
-  }; // @cast-boundary error-details
-  return (
-    error.code === "unique_violation" &&
-    error.details?.constraintName === FORM_DRAFT_UNIQUE_KEY_CONSTRAINT
-  );
-}
-
-const SAVE_DRAFT_COUNT_REASON =
-  "COUNT(*) of the caller's own drafts without loading 64KB value blobs";
-
 export const saveDraftWrite = defineWriteHandler({
   name: "save",
   schema: saveDraftPayloadSchema,
@@ -69,7 +59,7 @@ export const saveDraftWrite = defineWriteHandler({
 
     const result = await formDraftExecutor.create({ ownerId, draftKey, draft }, event.user, ctx.db);
     if (result.isSuccess) return result;
-    if (!isDraftKeyConflict(result)) return result;
+    if (!isUniqueConstraintFailure(result, FORM_DRAFT_UNIQUE_KEY_CONSTRAINT)) return result;
 
     const winner = await lookupDraft(ctx.db, event.user.tenantId, ownerId, draftKey);
     if (!winner) return result;

package/packages/bundled-features/src/host-routing/README.md

@@ -55,16 +55,16 @@ the app sets it.
 
 ## Options
 
-| Option | Meaning |
-|---|---|
-| `tenantBy` | `"host"` (`<key>.<baseDomain>`) or `"path"` with `tenantPathPrefix` (`/t/<key>/...` on the apex) |
-| `baseDomain` | Apex hostname, lowercase, no port. `www.<baseDomain>` counts as apex |
-| `apex` | `{ file, csp?, localeFiles? }` for the apex |
-| `tenant` | `{ file, csp? }` for a known tenant and for the bare path prefix |
-| `unknownTenant` | `{ file, csp? }` served with 404; omit for a bare 404 |
-| `hosts` | Further fixed hostnames with their own surface, checked first |
-| `apexAnonymousTenantId` | Tenant for anonymous API calls on the apex (e.g. `SYSTEM_TENANT_ID` for public signup); omit and the apex has none |
-| `locales` | `{ default, prefixed }`: `/<default>/...` answers 301 to the unprefixed path, `/<prefixed>/...` serves `apex.localeFiles[locale]` |
+| Option                  | Meaning                                                                                                                           |
+| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
+| `tenantBy`              | `"host"` (`<key>.<baseDomain>`) or `"path"` with `tenantPathPrefix` (`/t/<key>/...` on the apex)                                  |
+| `baseDomain`            | Apex hostname, lowercase, no port. `www.<baseDomain>` counts as apex                                                              |
+| `apex`                  | `{ file, csp?, localeFiles? }` for the apex                                                                                       |
+| `tenant`                | `{ file, csp? }` for a known tenant and for the bare path prefix                                                                  |
+| `unknownTenant`         | `{ file, csp? }` served with 404; omit for a bare 404                                                                             |
+| `hosts`                 | Further fixed hostnames with their own surface, checked first                                                                     |
+| `apexAnonymousTenantId` | Tenant for anonymous API calls on the apex (e.g. `SYSTEM_TENANT_ID` for public signup); omit and the apex has none                |
+| `locales`               | `{ default, prefixed }`: `/<default>/...` answers 301 to the unprefixed path, `/<prefixed>/...` serves `apex.localeFiles[locale]` |
 
 A `csp` replaces runProdApp's default CSP for that surface; without it the
 default applies. Options are validated when the feature or dispatch is built.

package/packages/bundled-features/src/inbound-mail-foundation/feature.ts

@@ -228,12 +228,8 @@ export function createInboundMailFoundationFeature(options: InboundMailRoleOptio
 
       // Plugin extension point — providers register via
       // r.useExtension("inboundMailProvider", "<key>", plugin).
-      r.extendsRegistrar(INBOUND_MAIL_PROVIDER_EXTENSION, {
-        onRegister: () => {
-          // No side-effects at register-time — lookup happens at runtime
-          // via resolveInboundProviderForKey/-Account.
-        },
-      });
+      // Lookup happens at runtime via resolveInboundProviderForKey/-Account.
+      r.extendsRegistrar(INBOUND_MAIL_PROVIDER_EXTENSION, {});
 
       // Sync machinery: high-frequency tick state, deliberately NOT
       // event-sourced — r.storeTable keeps the migration DDL but excludes the

package/packages/bundled-features/src/inbound-mail-foundation/handlers/thread-rollup.ts

@@ -107,6 +107,7 @@ export async function appendThreadRollup(
     // @cast-boundary engine-payload — eigene events, shape via defineEvent
     const previousThread = lastThreadEvent?.payload as MailThreadEventPayload | undefined;
     const previousLastAt = previousThread?.lastMessageAtIso ?? "";
+    // biome-ignore lint/complexity/useMathMinMax: ISO strings compare lexicographically; Math.max would coerce them to NaN
     const newLastAt = receivedAtIso > previousLastAt ? receivedAtIso : previousLastAt;
     const messageCount = await countWhere(threadRollupRunner, inboundMessagesProjectionTable, {
       tenantId,

package/packages/bundled-features/src/inbound-mail-foundation/oauth-state.ts

@@ -11,9 +11,10 @@
 // in the HMAC input, timing-safe comparison, expiry in the clear-text
 // segment).
 
-import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
+import { randomUUID } from "node:crypto";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
+import { hmacSignatureMatches, signHmacSha256Base64Url } from "../shared/index.ts";
 
 const STATE_PURPOSE = "inbound-mail-oauth-connect";
 
@@ -34,10 +35,6 @@ export type VerifyOAuthStateResult =
   | { readonly ok: true; readonly payload: OAuthStatePayload }
   | { readonly ok: false; readonly reason: "malformed" | "bad_signature" | "expired" };
 
-function sign(input: string, secret: string): string {
-  return createHmac("sha256", secret).update(input).digest("base64url");
-}
-
 function hmacInput(payloadB64: string, expiresAtMs: number): string {
   return `${STATE_PURPOSE}:${payloadB64}.${expiresAtMs}`;
 }
@@ -51,7 +48,7 @@ export function signOAuthState(
   const full: OAuthStatePayload = { ...payload, nonce: randomUUID() };
   const payloadB64 = Buffer.from(JSON.stringify(full), "utf8").toString("base64url");
   const expiresAtMs = now.add({ minutes: ttlMinutes }).epochMilliseconds;
-  const signature = sign(hmacInput(payloadB64, expiresAtMs), secret);
+  const signature = signHmacSha256Base64Url(hmacInput(payloadB64, expiresAtMs), secret);
   return `${payloadB64}.${expiresAtMs}.${signature}`;
 }
 
@@ -70,13 +67,8 @@ export function verifyOAuthState(
     return { ok: false, reason: "malformed" };
   }
 
-  const expected = sign(hmacInput(payloadB64, expiresAtMs), secret);
-  const expectedBuf = Buffer.from(expected, "base64url");
-  const providedBuf = Buffer.from(providedSig, "base64url");
-  // Check the length before timingSafeEqual: it throws on a length mismatch,
-  // and the throw itself leaks information through timing.
-  if (expectedBuf.length !== providedBuf.length) return { ok: false, reason: "bad_signature" };
-  if (!timingSafeEqual(expectedBuf, providedBuf)) return { ok: false, reason: "bad_signature" };
+  const expected = signHmacSha256Base64Url(hmacInput(payloadB64, expiresAtMs), secret);
+  if (!hmacSignatureMatches(expected, providedSig)) return { ok: false, reason: "bad_signature" };
 
   if (Temporal.Instant.compare(now, Temporal.Instant.fromEpochMilliseconds(expiresAtMs)) > 0) {
     return { ok: false, reason: "expired" };

package/packages/bundled-features/src/inbound-mail-foundation/tenant-destroy-hook.ts

@@ -16,8 +16,8 @@
 // unreadable. These hooks dispose of the rows.
 
 import type { EntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
-import { declareEscapeHatch, type TenantDataHookCtx } from "@cosmicdrift/kumiko-framework/engine";
-import { archiveStream } from "@cosmicdrift/kumiko-framework/event-store";
+import type { TenantDataHookCtx } from "@cosmicdrift/kumiko-framework/engine";
+import { archiveAndDeleteTenantRows } from "../tenant-lifecycle/index.ts";
 import { seenMessageTable, syncCursorTable } from "./entities.ts";
 import {
   INBOUND_MESSAGE_AGGREGATE_TYPE,
@@ -32,31 +32,21 @@ import {
 } from "./projection.ts";
 import { quarantineTable } from "./quarantine-entities.ts";
 
-const ARCHIVED_BY = "tenant-lifecycle:destroy";
-const REASON = "tenant_destroy";
-
 // archiveStream sits outside TenantDb's own methods — needs the escape hatch.
 export const INBOUND_MAIL_TENANT_DESTROY_ARCHIVE_REASON =
   "tenant-destroy archives each inbound-mail entity's event-streams before the projection rows are deleted";
 
-async function archiveAndDeleteRows(
+function archiveAndDeleteRows(
   ctx: TenantDataHookCtx,
   table: EntityTableMeta,
   aggregateType: string,
 ): Promise<readonly string[]> {
-  declareEscapeHatch({ reason: INBOUND_MAIL_TENANT_DESTROY_ARCHIVE_REASON });
-  const rows = await ctx.db.selectMany<{ id: string }>(table, { tenantId: ctx.tenantId });
-  for (const row of rows) {
-    await archiveStream(ctx.db.unsafeRaw(), {
-      tenantId: ctx.tenantId,
-      aggregateId: row.id,
-      aggregateType,
-      archivedBy: ARCHIVED_BY,
-      reason: REASON,
-    });
-  }
-  await ctx.db.deleteMany(table, { tenantId: ctx.tenantId });
-  return rows.map((row) => row.id);
+  return archiveAndDeleteTenantRows(
+    ctx,
+    table,
+    aggregateType,
+    INBOUND_MAIL_TENANT_DESTROY_ARCHIVE_REASON,
+  );
 }
 
 export async function mailAccountTenantDestroyHook(ctx: TenantDataHookCtx): Promise<void> {

package/packages/bundled-features/src/jobs/handlers/tenant-failures.query.ts

@@ -2,8 +2,8 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { serializeJobSubject } from "@cosmicdrift/kumiko-framework/jobs";
-import { parseJsonSafe } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
+import { parseSubject } from "../parse-subject.ts";
 import { tenantJobFailuresTable } from "../tenant-job-failure-table.ts";
 
 type TenantJobFailureRow = {
@@ -16,20 +16,6 @@ type TenantJobFailureRow = {
 
 const DEFAULT_LIMIT = 50;
 
-function isSubjectEntry(value: unknown): value is [string, unknown] {
-  return Array.isArray(value) && typeof value[0] === "string";
-}
-
-function parseSubject(stored: string | null): Record<string, unknown> | null {
-  if (stored === null) return null;
-  // A corrupt subject must not fail the whole list — the record still tells
-  // the tenant which job failed and why. parseJsonSafe only survives a
-  // SyntaxError, so the shape needs its own check.
-  const parsed = parseJsonSafe<unknown>(stored, null);
-  if (!Array.isArray(parsed)) return null;
-  return Object.fromEntries(parsed.filter(isSubjectEntry));
-}
-
 export function createTenantFailuresQuery(readRoles: readonly string[]) {
   return defineQueryHandler({
     name: "failures",

package/packages/bundled-features/src/jobs/handlers/tenant-runs.query.ts

@@ -2,8 +2,8 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { serializeJobSubject } from "@cosmicdrift/kumiko-framework/jobs";
-import { parseJsonSafe } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
+import { parseSubject } from "../parse-subject.ts";
 import { type TenantJobRunStatus, tenantJobRunsTable } from "../tenant-job-run-table.ts";
 
 type TenantJobRunRow = {
@@ -19,19 +19,6 @@ type TenantJobRunRow = {
 
 const DEFAULT_LIMIT = 50;
 
-function isSubjectEntry(value: unknown): value is [string, unknown] {
-  return Array.isArray(value) && typeof value[0] === "string";
-}
-
-function parseSubject(stored: string | null): Record<string, unknown> | null {
-  if (stored === null) return null;
-  // A corrupt subject must not fail the whole list; parseJsonSafe only
-  // survives a SyntaxError, so the shape needs its own check.
-  const parsed = parseJsonSafe<unknown>(stored, null);
-  if (!Array.isArray(parsed)) return null;
-  return Object.fromEntries(parsed.filter(isSubjectEntry));
-}
-
 export function createTenantRunsQuery(readRoles: readonly string[]) {
   return defineQueryHandler({
     name: "tenant-runs",

package/packages/bundled-features/src/jobs/job-run-logger.ts

@@ -153,6 +153,27 @@ async function encryptLogMessages<T extends { readonly message: string }>(
   }));
 }
 
+async function insertEncryptedRunLogs(
+  db: DbConnection,
+  runId: string,
+  triggeredById: string | null,
+  logs: readonly { readonly level: string; readonly message: string; readonly timestamp: string }[],
+): Promise<void> {
+  // skip: empty log batch — the worker ran silent, no child rows to insert
+  if (logs.length === 0) return;
+  const encryptedLogs = await encryptLogMessages(logs, triggeredById);
+  await insertMany(
+    db,
+    jobRunLogsTable,
+    encryptedLogs.map((log) => ({
+      runId,
+      level: log.level,
+      message: log.message,
+      timestamp: parseJobInstant(log.timestamp),
+    })),
+  );
+}
+
 // Mirrors encryptFailureError for the failure-path `error` column:
 // stored alongside logs[].message under the same triggering user's DEK, so
 // a log/error pair from the same failed run decrypt together or erase
@@ -349,14 +370,7 @@ async function recordTenantRunOutcome(
   // A failed attempt BullMQ will retry goes back to waiting: the tenant keeps
   // seeing pending work, not a failure the next attempt may still resolve.
   if (result === "failed" && !outcome.finalAttempt) {
-    await inTenantScope(key.tenantId, () =>
-      updateMany(
-        db,
-        tenantJobRunsTable,
-        { status: "queued", startedAt: null, finishedAt: null, updatedAt: now },
-        { tenantId: key.tenantId, jobName, bullJobId },
-      ),
-    );
+    await markTenantRunQueued(db, key.tenantId, jobName, bullJobId, now);
     // skip: retry pending, the row stays active until the final attempt
     return;
   }
@@ -403,12 +417,22 @@ async function requeueTenantRun(
   const key = tenantRunKey(jobName, meta.tenantVisibleRun.tenantId, meta.tenantVisibleRun.subject);
   // skip: system-tenant run, no tenant-scoped query reads it
   if (!key) return;
-  await inTenantScope(key.tenantId, () =>
+  await markTenantRunQueued(db, key.tenantId, jobName, bullJobId, Temporal.Now.instant());
+}
+
+async function markTenantRunQueued(
+  db: DbConnection,
+  tenantId: string,
+  jobName: string,
+  bullJobId: string,
+  updatedAt: Temporal.Instant,
+): Promise<void> {
+  await inTenantScope(tenantId, () =>
     updateMany(
       db,
       tenantJobRunsTable,
-      { status: "queued", startedAt: null, finishedAt: null, updatedAt: Temporal.Now.instant() },
-      { tenantId: key.tenantId, jobName, bullJobId },
+      { status: "queued", startedAt: null, finishedAt: null, updatedAt },
+      { tenantId, jobName, bullJobId },
     ),
   );
 }
@@ -672,21 +696,7 @@ export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallb
         },
         { id: runId },
       );
-      // skip: empty log batch — the worker ran silent. No child rows to
-      // insert; the status update above already recorded completion.
-      if (payload.logs.length > 0) {
-        const encryptedLogs = await encryptLogMessages(payload.logs, triggeredById);
-        await insertMany(
-          db,
-          jobRunLogsTable,
-          encryptedLogs.map((log) => ({
-            runId,
-            level: log.level,
-            message: log.message,
-            timestamp: parseJobInstant(log.timestamp),
-          })),
-        );
-      }
+      await insertEncryptedRunLogs(db, runId, triggeredById, payload.logs);
       runIdByBullJobId.delete(bullJobId); // immediate cleanup on terminal callback
     },
 
@@ -746,20 +756,7 @@ export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallb
         },
         { id: runId },
       );
-      // skip: empty log batch — mirror of onJobComplete
-      if (payload.logs.length > 0) {
-        const encryptedLogs = await encryptLogMessages(payload.logs, triggeredById);
-        await insertMany(
-          db,
-          jobRunLogsTable,
-          encryptedLogs.map((log) => ({
-            runId,
-            level: log.level,
-            message: log.message,
-            timestamp: parseJobInstant(log.timestamp),
-          })),
-        );
-      }
+      await insertEncryptedRunLogs(db, runId, triggeredById, payload.logs);
       runIdByBullJobId.delete(bullJobId); // immediate cleanup on terminal callback
     },
   };

package/packages/bundled-features/src/jobs/parse-subject.ts

@@ -0,0 +1,15 @@
+import { parseJsonSafe } from "@cosmicdrift/kumiko-framework/utils";
+
+function isSubjectEntry(value: unknown): value is [string, unknown] {
+  return Array.isArray(value) && typeof value[0] === "string";
+}
+
+// A corrupt subject must not fail the whole list: the record still tells the
+// tenant which job failed. parseJsonSafe only survives a SyntaxError, so the
+// shape needs its own check.
+export function parseSubject(stored: string | null): Record<string, unknown> | null {
+  if (stored === null) return null;
+  const parsed = parseJsonSafe<unknown>(stored, null);
+  if (!Array.isArray(parsed)) return null;
+  return Object.fromEntries(parsed.filter(isSubjectEntry));
+}

package/packages/bundled-features/src/ledger/feature.ts

@@ -21,6 +21,7 @@ import {
   defineFeature,
   type FeatureRegistrar,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { resolveFeatureAccess } from "../shared/index.ts";
 import { accountEntity, scheduleEntity, transactionEntity } from "./entity.ts";
 import { createConfirmSchedulePeriodHandler } from "./handlers/confirm-schedule-period.write.ts";
 import { createCreateTransactionHandler } from "./handlers/create-transaction.write.ts";
@@ -166,18 +167,12 @@ export type LedgerFeatureOptions = {
   readonly toggleable?: LedgerToggleable;
 };
 
-function resolveAccess(opts: LedgerFeatureOptions): AccessRule {
-  if (opts.access !== undefined) return opts.access;
-  if (opts.roles !== undefined) return { roles: opts.roles };
-  return DEFAULT_LEDGER_ACCESS;
-}
-
 // Options wrapper. Without options returns the module-level singleton (no
 // rebuild). access/roles/toggleable build a fresh feature-definition.
 export function createLedgerFeature(opts: LedgerFeatureOptions = {}): typeof defaultLedgerFeature {
   if (opts.access === undefined && opts.roles === undefined && opts.toggleable === undefined) {
     return defaultLedgerFeature;
   }
-  const access = resolveAccess(opts);
+  const access = resolveFeatureAccess(opts, DEFAULT_LEDGER_ACCESS);
   return defineFeature(LEDGER_FEATURE_NAME, (r) => registerLedger(r, access, opts.toggleable));
 }

package/packages/bundled-features/src/legal-pages/README.md

@@ -25,7 +25,7 @@ import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 runProdApp({
   envSchema, // composeEnvSchema({ core: frameworkCoreEnvSchema, features })
   features: [
-    createTemplateResolverFeature(),  // legal-pages requires template-resolver
+    createTemplateResolverFeature(), // legal-pages requires template-resolver
     createLegalPagesFeature(),
     /* ... */
   ],
@@ -60,12 +60,12 @@ See [template-resolver/README.md](../template-resolver/README.md).
 
 **Default** (DACH: DE required, EN optional):
 
-| Path | Slug + locale | Title fallback (when block empty) |
-|---|---|---|
-| `GET /legal/impressum` | `imprint` / `de` | "Impressum" |
-| `GET /legal/datenschutz` | `privacy` / `de` | "Datenschutzerklärung" |
-| `GET /legal/imprint` | `imprint` / `en` | "Imprint" |
-| `GET /legal/privacy` | `privacy` / `en` | "Privacy Policy" |
+| Path                     | Slug + locale    | Title fallback (when block empty) |
+| ------------------------ | ---------------- | --------------------------------- |
+| `GET /legal/impressum`   | `imprint` / `de` | "Impressum"                       |
+| `GET /legal/datenschutz` | `privacy` / `de` | "Datenschutzerklärung"            |
+| `GET /legal/imprint`     | `imprint` / `en` | "Imprint"                         |
+| `GET /legal/privacy`     | `privacy` / `en` | "Privacy Policy"                  |
 
 Response:
 - `200 text/html` — block exists + has content. Cache header `public, max-age=300`.
@@ -112,11 +112,19 @@ that needs an additional page (terms/AGB), passes its own lists:
 createLegalPagesFeature({
   routes: [
     { path: "/legal/aviso-legal", slug: "imprint", lang: "es", titleFallback: "Aviso legal" },
-    { path: "/legal/privacidad", slug: "privacy", lang: "es", titleFallback: "Política de privacidad" },
+    {
+      path: "/legal/privacidad",
+      slug: "privacy",
+      lang: "es",
+      titleFallback: "Política de privacidad",
+    },
     { path: "/legal/terminos", slug: "terms", lang: "es", titleFallback: "Términos y condiciones" },
   ],
-  requiredBlocks: [{ slug: "imprint", lang: "es" }, { slug: "privacy", lang: "es" }],
-})
+  requiredBlocks: [
+    { slug: "imprint", lang: "es" },
+    { slug: "privacy", lang: "es" },
+  ],
+});
 ```
 
 `slug` is free-form — it only has to match the `slug` you seed the
@@ -162,10 +170,10 @@ starts and checks whether the required blocks exist in SYSTEM_TENANT.
 A throw rejects the boot, so the process never reports ready.
 **Default** (DACH):
 
-| Slug + locale | What happens when missing |
-|---|---|
+| Slug + locale    | What happens when missing                                                                 |
+| ---------------- | ----------------------------------------------------------------------------------------- |
 | `imprint` / `de` | **Production:** `throw new Error(...)` blocks app start. **Dev:** `ctx.obs.log.warn(...)` |
-| `privacy` / `de` | as above |
+| `privacy` / `de` | as above                                                                                  |
 
 EN versions are **not** boot-fail-relevant by default (`LEGAL_OPTIONAL_BLOCKS`).
 Routes return `404` if an EN block is missing.

package/packages/bundled-features/src/mail-foundation/feature.ts

@@ -141,13 +141,9 @@ export function createMailFoundationFeature() {
       // Plugin extension-point. Provider-features register here. The
       // entityName at registration time becomes the value tenants pick in
       // `provider` config-key (e.g. "smtp", "brevo-api").
-      r.extendsRegistrar(MAIL_TRANSPORT_EXTENSION, {
-        onRegister: () => {
-          // No side-effects at register-time — the registry stores the
-          // usage, factory looks it up at request-time. Same shape as
-          // delivery's extendsRegistrar.
-        },
-      });
+      // The registry stores the usage, factory looks it up at request-time. Same shape as
+      // delivery's extendsRegistrar.
+      r.extendsRegistrar(MAIL_TRANSPORT_EXTENSION, {});
 
       // Empty = this tenant has no own provider: tenantMailTransport yields null and
       // channel-email uses the app transport, so empty is a valid choice a tenant can