@owlmeans/server-job 0.1.18-rc.2 → 0.1.18-rc.20

package/README.md

@@ -1,101 +1,51 @@
 # @owlmeans/server-job
 
-The read side of a queue, as entrypoints an application elevates: list, get, cancel and a socket
-that pushes lifecycle events. Jobs themselves are enqueued and processed through
-[`@owlmeans/queue`](../queue) and its driver — nothing here produces or consumes work.
-
-## Overview
-
-- `declareJobEntrypoints(root, opts?)` — the four declarations, for the app's SHARED package
-- `serveJobEntrypoints(entrypoints, root, opts?)` — elevate them with this package's handlers
-- `listJobs` / `getJob` / `cancelJob` / `watchJobs` — the handlers, when an app elevates by hand
-- A caller sees only the jobs it owns; the escape hatch is an option, not a hardcoded permission
-
-## Installation
-
-```bash
-bun add @owlmeans/server-job@^0.1.18-rc.0
-```
-
-## Usage
-
-Declare the group once, in the package both halves import:
+Server bridge from technical queue records to the sanitized `@owlmeans/job` domain contract.
+Every binding requires an application-owned `JobExposurePolicy`; there is no permissive default.
 
 ```typescript
-import { declareJobEntrypoints } from '@owlmeans/server-job'
-
-export const REPORTS = 'reports'
-export const entrypoints = [
-  ...declareJobEntrypoints(REPORTS, { path: '/reports/jobs', parent: app.api.base }),
-]
-```
-
-Serve it in the API process, alongside the queue driver it already wires:
-
-```typescript
-import { serveJobEntrypoints } from '@owlmeans/server-job'
-import { appendRedisQueue } from '@owlmeans/redis-queue'
-
-appendRedisQueue(context)
-serveJobEntrypoints(entrypoints, REPORTS, { queue: REPORT_QUEUE })
-context.registerEntrypoints(entrypoints)
-```
-
-Enqueue with the owner in the payload — that is what every read here filters on:
+import { declareJobEntrypoints } from '@owlmeans/job'
+import { jobViewOf, serveJobEntrypoints } from '@owlmeans/server-job'
 
-```typescript
-await context.jobs<ReportJob, ReportResult>(REPORT_QUEUE).create({
-  name: 'report:build',
-  data: { owner: req.auth!.profileId ?? req.auth!.userId, target: id },
+export const reportJobs = declareJobEntrypoints('report-jobs', {
+  path: '/reports/jobs', parent: api.reports.base,
 })
-```
-
-And report progress from the processor, so there is something to watch:
-
-```typescript
-worker.process(REPORT_QUEUE, 'report:build', async job => {
-  for (const [done, page] of pages.entries()) {
-    await job.touch()
-    await job.progress({ done, total: pages.length })
-    await render(page)
-  }
-  return { url }
-})
-```
 
-## Ownership
-
-`data.owner` (rename it with `ownerField`) is compared against `auth.profileId ?? auth.userId`.
-A job that exists but belongs to someone else answers exactly as an absent one: `UnknownJob`.
-
-An operator console passes a predicate instead of a permission name:
-
-```typescript
-serveJobEntrypoints(entrypoints, REPORTS, {
+export const bindings = serveJobEntrypoints(reportJobs, {
   queue: REPORT_QUEUE,
-  admin: req => req.auth?.scopes?.includes('ops') === true,
+  policy: {
+    audience: req => ({ userId: requireUserId(req) }),
+    where: (audience, query) => ({
+      $and: [
+        { 'data.ownerId': audience.userId },
+        ...(query.kind == null ? [] : [{ name: internalNameOf(query.kind) }]),
+      ],
+    }),
+    lookup: async (id, audience, resource) =>
+      resource.load({ publicId: id, 'data.ownerId': audience.userId }),
+    map: record => jobViewOf(record, {
+      id: publicIdOf(record),
+      kind: publicKindOf(record),
+      summary: publicSummaryOf(record),
+      metadata: allowlistedMetadataOf(record),
+      result: publicResultOf(record),
+    }),
+    cancel: (record, audience) => ownerIdOf(record) === audience.userId,
+  },
 })
 ```
 
-## The one gotcha
-
-A `JobEvent` carries no owner, so `watchJobs` attributes each frame by reading its job back. A
-queue configured with `removeOnComplete` has nothing left to read when the completion arrives, and
-an unattributable frame is dropped rather than fanned out. Leave completed jobs in place on any
-queue that is watched.
-
-## Depends On
-
-- [`@owlmeans/queue`](../queue) — `ctx.jobs(queue)`, `JobRecord`, `JobEvent`, `UnknownJob`
-- [`@owlmeans/server-api`](../server-api) — `handleRequest` / `handleParams`
-- [`@owlmeans/server-socket`](../server-socket) — `handleConnection`
-- [`@owlmeans/server-entrypoint`](../server-entrypoint) — `elevate`
-- [`@owlmeans/auth-common`](../auth-common) — `DEFAULT_GUARD`
+The policy is the security boundary:
 
-## Related
+- `audience` derives authenticated application scope.
+- `where` translates the closed public query into scoped technical criteria.
+- `lookup` resolves an opaque public id inside that scope.
+- `map` allowlists fields and returns only `JobView`; `jobViewOf` bounds and sanitizes JSON.
+- `cancel` is optional and cancellation is denied unless it explicitly approves.
 
-- [`@owlmeans/client-job`](../client-job) — the browser half that addresses these entrypoints
-- [`@owlmeans/web-panel`](../web-panel) `./jobs` — `JobProgress`, `JobStatus`, `useJobToasts`
+List, get, cancel and watch all apply the same policy. Watch frames are reloaded inside the
+audience scope and emitted as `JobViewEvent`; an unattributable event is dropped. Keep completed
+records long enough for watched completion events to be projected.
 
 <!-- owlmeans:agent-guidance:start -->
 ## Agent guidance
@@ -105,7 +55,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.14
+npx @owlmeans/agent-skills@^0.1.18-rc.33
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-job",
-  "version": "0.1.18-rc.2",
-  "generatedAt": "2026-09-10T23:12:07.514Z",
+  "version": "0.1.18-rc.20",
+  "generatedAt": "2026-09-22T18:27:08.242Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-job/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: server-job
-description: How to use @owlmeans/server-job — declaring and elevating the list/get/cancel/watch entrypoints over a queue, the ownership rule that scopes them to the authenticated subject, the admin escape hatch, and the socket that pushes JobEvent frames. Auto-invoked when exposing queue jobs to an application's UI or importing job entrypoint helpers.
+description: How to expose technical queue work as sanitized application JobView data through a mandatory authenticated policy. Auto-invoked when binding @owlmeans/server-job or building UI-visible application job status.
 user-invocable: false
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
@@ -8,133 +8,86 @@ user-invocable: false
 # @owlmeans/server-job
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-job": "^0.1.18-rc.2"` in `dependencies`
-
-The READ side of a queue. `@owlmeans/queue` and its driver enqueue and process; this package turns
-what they leave behind into four entrypoints an application elevates, so that "a long job reports
-progress to the user's screen" is wiring rather than code.
-
-## Key Exports
-
-| Export | Description |
-|--------|-------------|
-| `declareJobEntrypoints(root, opts?)` | The four declarations of one job group, for the SHARED package |
-| `jobEntrypointAliases(root)` | `{ base, list, get, cancel, watch }` — the alias shape both halves use |
-| `serveJobEntrypoints(entrypoints, root, opts?)` | Elevate the group with this package's handlers |
-| `listJobs(opts?)` / `getJob(opts?)` / `cancelJob(opts?)` | The HTTP handlers, for elevating by hand |
-| `watchJobs(opts?)` | The socket handler — pushes `JobEvent` frames under `JOB_EVENT` |
-| `jobOwnerOf(req)` / `requireJobOwner(req)` / `jobViewer(req, ctx, opts?)` | Who a request reads as |
-| `jobScope(viewer, opts?)` / `owns(record, viewer, opts?)` / `readOwnedJob(...)` | Applying that to records |
-| `ownerFieldOf(opts?)` / `ownerOf(record, opts?)` | The configured owner field, and what one record says its owner is |
-| `jobsOf(ctx, opts?)` | The `QueueResource` a group reads |
-| `JobListQuerySchema` | The list query's ajv schema, for a filter of your own |
-| `JobEntrypointAliases` / `JobEntrypointOptions` / `JobHandlerOptions` / `JobAdminCheck` / `JobListQuery` | The alias and option shapes |
-| Constants | `DEFAULT_JOB_ROOT` (`jobs`), `DEFAULT_JOB_PATH` (`/jobs`), `DEFAULT_OWNER_FIELD` (`owner`), `DEFAULT_JOB_SORT` (`createdAt`), `JOB_EVENT` (`job-event`) |
-
-## Declaring, once, in the shared package
-
-A group is a root alias plus a path. Everything under it is derived, so a target app declares it in
-the package its API and its browser both import, and neither side ever writes a path:
+**Install:** `"@owlmeans/server-job": "^0.1.18-rc.20"` in `dependencies`
 
-```typescript
-import { declareJobEntrypoints } from '@owlmeans/server-job'
-
-export const REPORTS = 'reports'
-export const entrypoints = [
-  ...declareJobEntrypoints(REPORTS, { path: '/reports/jobs', parent: app.api.base }),
-]
-```
-
-Aliases are `<root>`, `<root>:list`, `<root>:get`, `<root>:cancel`, `<root>:watch`. **That shape,
-and the `job-event` frame name, are the whole contract with `@owlmeans/client-job`** — the two
-packages restate them instead of sharing a module, because this one pulls fastify in and a browser
-bundle must not.
+This package is the boundary between technical `@owlmeans/queue` records and the safe
+`@owlmeans/job` contract. `serveJobEntrypoints` requires a `JobExposurePolicy`; there is no default
+owner field, administrator bypass or raw-record response.
 
-The guard rides on the base alone and the other four inherit it. It defaults to `DEFAULT_GUARD`
-because ownership is derived from the authenticated subject, and an unguarded group has no subject
-to derive it from — `guard: null` is for a group scoped some other way, and its handlers then
-answer `AuthorizationError`. `service` points the group at another app's route; `path` moves it.
+## Declare the public contract
 
-`/watch` is declared before `/:id` so the static branch reads first. Declaring a second group is
-the same call with another root.
-
-## Serving
+Declare routes with `@owlmeans/job`, in the narrow package shared by this API and its client:
 
 ```typescript
-import { serveJobEntrypoints } from '@owlmeans/server-job'
-import { appendRedisQueue } from '@owlmeans/redis-queue'
-
-appendRedisQueue(context)
-serveJobEntrypoints(entrypoints, REPORTS, { queue: REPORT_QUEUE })
-context.registerEntrypoints(entrypoints)
-```
+import { declareJobEntrypoints } from '@owlmeans/job'
 
-`elevate` replaces in place, so an app wanting one handler of its own elevates that alias again
-afterwards. `queue` names which declared queue the group reads; omitted, `ctx.jobs()` answers with
-the sole declared queue and refuses to guess once there are two. Passing an array that carries no
-group under that root is a `SyntaxError` — the declarations and the serving call must name the same
-root, and they usually do because both read it from one exported constant.
-
-## The ownership rule
-
-**A caller sees only the jobs it owns**, and ownership lives in the job's own payload — a
-`JobRecord` has no owner column, so the producer writes it:
-
-```typescript
-await context.jobs(REPORT_QUEUE).create({
-  name: 'report:build',
-  data: { owner: req.auth!.profileId ?? req.auth!.userId, target: id },
+export const reportJobs = declareJobEntrypoints('report-jobs', {
+  path: '/reports/jobs', parent: api.reports.base,
 })
 ```
 
-Reads filter on `data.owner` (`ownerField` renames it) against `auth.profileId ?? auth.userId` —
-profile first, the same subject `@owlmeans/server-socket` addresses a connection by, so one profile
-of a multi-profile account does not see another's work.
+These are ordinary guarded HTTP/WS declarations. They carry no queue name or broker option.
 
-A job that exists but belongs to someone else answers **`UnknownJob`, exactly as an absent one
-does**. Telling the two apart is what turns a broker id space into an enumeration oracle.
-
-The escape hatch is a predicate, never a permission name — which permission, gate or role means
-"operator" is the application's decision:
+## Bind the bridge
 
 ```typescript
-serveJobEntrypoints(entrypoints, REPORTS, {
+import { jobViewOf, serveJobEntrypoints } from '@owlmeans/server-job'
+
+export const reportJobBindings = serveJobEntrypoints(reportJobs, {
   queue: REPORT_QUEUE,
-  admin: req => req.auth?.scopes?.includes('ops') === true,
+  policy: {
+    audience: req => ({ userId: requireUserId(req) }),
+    where: (audience, query) => ({
+      $and: [
+        { 'data.ownerId': audience.userId },
+        ...(query.kind == null ? [] : [{ name: internalNameOf(query.kind) }]),
+      ],
+    }),
+    lookup: async (id, audience, resource) =>
+      resource.load({ publicId: id, 'data.ownerId': audience.userId }),
+    map: record => jobViewOf(record, {
+      id: publicIdOf(record),
+      kind: publicKindOf(record),
+      summary: publicSummaryOf(record),
+      metadata: allowlistedMetadataOf(record),
+      result: publicResultOf(record),
+    }),
+    cancel: (record, audience) => ownerIdOf(record) === audience.userId,
+  },
 })
 ```
 
-Absent an `admin` check every read is scoped and an anonymous request is refused, so a group wired
-with no options at all is closed rather than open.
-
-## What each handler answers
+Every policy part is load-bearing:
 
-| Alias | Method | Answers |
-|---|---|---|
-| `<root>:list` | GET `/` | `ListResult<JobRecord>`, newest first by `createdAt`. `state`, `name`, `page`, `size` in the query. Paging is opt-in and driven by `size` (1–200): without one the whole scoped list comes back and a `page` alone counts for nothing, since a broker has no default page size. `state` and `name` are plain strings, so a driver state this package does not know still narrows the list |
-| `<root>:get` | GET `/:id` | One `JobRecord`, or `UnknownJob` |
-| `<root>:cancel` | DELETE `/:id` | The record that was removed. Cancellation IS deletion in the queue contract; it does not interrupt a processor mid-run |
-| `<root>:watch` | SOCKET `/watch` | `JobEvent` frames under `job-event`, as the queue publishes them. The subscription is released on the socket's system `close` frame, so a dropped browser stops the queue subscription behind it |
+| Part | Rule |
+|---|---|
+| `audience` | Derive authenticated application scope; never trust a body owner id |
+| `where` | Translate the closed public query into criteria that always include that scope |
+| `lookup` | Resolve an opaque public id only inside the same scope |
+| `map` | Explicitly allowlist public fields and return `JobView` |
+| `cancel` | Optional; absence or `false` denies cancellation |
 
-## The one gotcha
+`jobViewOf` maps technical states and timestamps, copies only fields the application supplies,
+bounds JSON depth/item/string size, strips prototype keys and non-JSON values, and never copies a
+raw failure. Use `publicJobError()` unless an application-safe message is explicitly available.
 
-**A `JobEvent` carries no owner.** `watchJobs` attributes each frame by reading its job back and
-remembers the ids that answered for the life of the connection. A queue configured with
-`removeOnComplete` therefore loses its completion events here — the record they would be
-attributed by is gone by the time the event arrives, and an unattributable frame is dropped rather
-than fanned out to everyone. **Leave completed jobs in place on any queue that is watched.**
+List, get, cancel and watch all use the same policy. A foreign id answers the same as an absent
+one. Watch reloads each event inside the audience scope and emits only `JobViewEvent`; an event that
+cannot be attributed is dropped. Keep completed records long enough for their completion event to
+be projected.
 
-## Depends On
+## Key exports
 
-- `@owlmeans/queue` — `ctx.jobs(queue)`, `JobRecord`, `JobEvent`, `JobState`, `UnknownJob`
-- `@owlmeans/server-api` — `handleRequest`, `handleParams`
-- `@owlmeans/server-socket` — `handleConnection`, and the guard enforcement that fills `req.auth`
-- `@owlmeans/server-entrypoint` — `elevate`
-- `@owlmeans/auth-common` — `DEFAULT_GUARD`
+| Export | Purpose |
+|---|---|
+| `serveJobEntrypoints` | Bind list/get/cancel/watch using a mandatory policy |
+| `listJobs` / `getJob` / `cancelJob` / `watchJobs` | Bind one handler manually |
+| `jobViewOf` | Safe record-to-view mapper |
+| `sanitizeJobJson` / `publicJobError` | Bounded JSON and safe failure helpers |
+| `JobExposurePolicy` / `JobHandlerOptions` | Application policy contracts |
 
 ## Related
 
-- `queue` — declaring queues, writing processors, and `job.progress()` (there is nothing to watch
-  without it)
-- `redis-queue` — the driver, its shutdown rule and its retention options
-- `client-job` — the browser half; `web-panel` — `./jobs` renders what it collects
+- `job` — the safe shared contract
+- `client-job` — browser state over `JobView`
+- `queue` and `redis-queue` — backend-only execution and storage

package/build/actions/cancel.d.ts

@@ -1,6 +1,5 @@
-import type { AbstractResponse } from '@owlmeans/entrypoint';
-import type { RefedEntrypointHandler } from '@owlmeans/server-entrypoint';
-import type { JobHandlerOptions } from '../types.js';
+import { handlers } from '@owlmeans/server-api';
+import type { Context, JobEntrypoints, JobHandlerOptions } from '../types.js';
 /**
  * Cancel a job and answer with what was cancelled.
  *
@@ -11,5 +10,5 @@ import type { JobHandlerOptions } from '../types.js';
  *
  * @throws {UnknownJob}
  */
-export declare const cancelJob: (opts?: JobHandlerOptions) => RefedEntrypointHandler<AbstractResponse<any>>;
+export declare const cancelJob: (protocol: JobEntrypoints['cancel'], opts: JobHandlerOptions) => ReturnType<ReturnType<typeof handlers<Context>>['params']>;
 //# sourceMappingURL=cancel.d.ts.map

package/build/actions/cancel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cancel.d.ts","sourceRoot":"","sources":["../../src/actions/cancel.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAGpD;;;;;;;;;GASG;AACH,eAAO,MAAM,SAAS,UACb,iBAAiB,KACvB,sBAAsB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAO3C,CAAA"}
+{"version":3,"file":"cancel.d.ts","sourceRoot":"","sources":["../../src/actions/cancel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAE/C,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAG7E;;;;;;;;;GASG;AACH,eAAO,MAAM,SAAS,aACV,cAAc,CAAC,QAAQ,CAAC,QAC5B,iBAAiB,KACtB,UAAU,CAAC,UAAU,CAAC,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAUxD,CAAA"}

package/build/actions/cancel.js

@@ -1,5 +1,6 @@
-import { handleParams } from '@owlmeans/server-api';
-import { jobViewer, jobsOf, readOwnedJob } from '../utils/index.js';
+import { handlers } from '@owlmeans/server-api';
+import { UnknownJob } from '@owlmeans/queue';
+import { jobsOf, readExposedJob } from '../utils/index.js';
 /**
  * Cancel a job and answer with what was cancelled.
  *
@@ -10,10 +11,14 @@ import { jobViewer, jobsOf, readOwnedJob } from '../utils/index.js';
  *
  * @throws {UnknownJob}
  */
-export const cancelJob = (opts) => handleParams(async ({ id }, ctx, req) => {
+export const cancelJob = (protocol, opts) => handlers().params(protocol, async ({ id }, ctx, req) => {
     const resource = jobsOf(ctx, opts);
-    // Read first: `take` cannot tell whose job it removed, so ownership is settled before it.
-    await readOwnedJob(resource, id, await jobViewer(req, ctx, opts), opts);
-    return await resource.take(id);
+    const audience = await opts.policy.audience(req, ctx);
+    const record = await readExposedJob(resource, id, audience, opts);
+    if (opts.policy.cancel == null || !await opts.policy.cancel(record, audience)) {
+        throw new UnknownJob('job');
+    }
+    const removed = await resource.take(record.id);
+    return await opts.policy.map(removed, audience);
 });
 //# sourceMappingURL=cancel.js.map

package/build/actions/cancel.js.map

@@ -1 +1 @@
-{"version":3,"file":"cancel.js","sourceRoot":"","sources":["../../src/actions/cancel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAInD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEnE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,IAAwB,EACuB,EAAE,CACjD,YAAY,CAAiB,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAClC,0FAA0F;IAC1F,MAAM,YAAY,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAA;IAEvE,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAChC,CAAC,CAAC,CAAA"}
+{"version":3,"file":"cancel.js","sourceRoot":"","sources":["../../src/actions/cancel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAE5C,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAE1D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,QAAkC,EAClC,IAAuB,EACqC,EAAE,CAC9D,QAAQ,EAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAClC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IACrD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;IACjE,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IAC7B,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAY,CAAC,CAAA;IACxD,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;AACjD,CAAC,CAAC,CAAA"}

package/build/actions/get.d.ts

@@ -1,10 +1,9 @@
-import type { AbstractResponse } from '@owlmeans/entrypoint';
-import type { RefedEntrypointHandler } from '@owlmeans/server-entrypoint';
-import type { JobHandlerOptions } from '../types.js';
+import { handlers } from '@owlmeans/server-api';
+import type { Context, JobEntrypoints, JobHandlerOptions } from '../types.js';
 /**
  * One job.
  *
  * @throws {UnknownJob} for an id that is absent AND for one that belongs to someone else.
  */
-export declare const getJob: (opts?: JobHandlerOptions) => RefedEntrypointHandler<AbstractResponse<any>>;
+export declare const getJob: (protocol: JobEntrypoints['get'], opts: JobHandlerOptions) => ReturnType<ReturnType<typeof handlers<Context>>['params']>;
 //# sourceMappingURL=get.d.ts.map

package/build/actions/get.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../src/actions/get.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAGpD;;;;GAIG;AACH,eAAO,MAAM,MAAM,UACV,iBAAiB,KACvB,sBAAsB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAK3C,CAAA"}
+{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../src/actions/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAG7E;;;;GAIG;AACH,eAAO,MAAM,MAAM,aACP,cAAc,CAAC,KAAK,CAAC,QACzB,iBAAiB,KACtB,UAAU,CAAC,UAAU,CAAC,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAMxD,CAAA"}

package/build/actions/get.js

@@ -1,12 +1,14 @@
-import { handleParams } from '@owlmeans/server-api';
-import { jobViewer, jobsOf, readOwnedJob } from '../utils/index.js';
+import { handlers } from '@owlmeans/server-api';
+import { jobsOf, readExposedJob } from '../utils/index.js';
 /**
  * One job.
  *
  * @throws {UnknownJob} for an id that is absent AND for one that belongs to someone else.
  */
-export const getJob = (opts) => handleParams(async ({ id }, ctx, req) => {
+export const getJob = (protocol, opts) => handlers().params(protocol, async ({ id }, ctx, req) => {
     const resource = jobsOf(ctx, opts);
-    return await readOwnedJob(resource, id, await jobViewer(req, ctx, opts), opts);
+    const audience = await opts.policy.audience(req, ctx);
+    const record = await readExposedJob(resource, id, audience, opts);
+    return await opts.policy.map(record, audience);
 });
 //# sourceMappingURL=get.js.map

package/build/actions/get.js.map

@@ -1 +1 @@
-{"version":3,"file":"get.js","sourceRoot":"","sources":["../../src/actions/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAInD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEnE;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CACpB,IAAwB,EACuB,EAAE,CACjD,YAAY,CAAiB,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAElC,OAAO,MAAM,YAAY,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAA;AAChF,CAAC,CAAC,CAAA"}
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../../src/actions/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAE/C,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAE1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CACpB,QAA+B,EAC/B,IAAuB,EACqC,EAAE,CAC9D,QAAQ,EAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAClC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IACrD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;IACjE,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;AAChD,CAAC,CAAC,CAAA"}

package/build/actions/list.d.ts

@@ -1,6 +1,5 @@
-import type { AbstractResponse } from '@owlmeans/entrypoint';
-import type { RefedEntrypointHandler } from '@owlmeans/server-entrypoint';
-import type { JobHandlerOptions } from '../types.js';
+import { handlers } from '@owlmeans/server-api';
+import type { Context, JobEntrypoints, JobHandlerOptions } from '../types.js';
 /**
  * The caller's jobs, newest first.
  *
@@ -9,5 +8,5 @@ import type { JobHandlerOptions } from '../types.js';
  * name filters go through the same criteria language as every other resource, so a filter written
  * for this list means the same thing applied to the store the browser holds.
  */
-export declare const listJobs: (opts?: JobHandlerOptions) => RefedEntrypointHandler<AbstractResponse<any>>;
+export declare const listJobs: (protocol: JobEntrypoints['list'], opts: JobHandlerOptions) => ReturnType<ReturnType<typeof handlers<Context>>['request']>;
 //# sourceMappingURL=list.d.ts.map

package/build/actions/list.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../src/actions/list.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAKzE,OAAO,KAAK,EAAE,iBAAiB,EAAgB,MAAM,aAAa,CAAA;AAGlE;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,UACZ,iBAAiB,KACvB,sBAAsB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAe7C,CAAA"}
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../src/actions/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAG/C,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAgB,MAAM,aAAa,CAAA;AAG3F;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,aACT,cAAc,CAAC,MAAM,CAAC,QAC1B,iBAAiB,KACtB,UAAU,CAAC,UAAU,CAAC,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAY3D,CAAA"}

package/build/actions/list.js

@@ -1,6 +1,5 @@
-import { handleRequest } from '@owlmeans/server-api';
-import { DEFAULT_JOB_SORT } from '../consts.js';
-import { jobScope, jobViewer, jobsOf } from '../utils/index.js';
+import { handlers } from '@owlmeans/server-api';
+import { jobsOf } from '../utils/index.js';
 /**
  * The caller's jobs, newest first.
  *
@@ -9,18 +8,17 @@ import { jobScope, jobViewer, jobsOf } from '../utils/index.js';
  * name filters go through the same criteria language as every other resource, so a filter written
  * for this list means the same thing applied to the store the browser holds.
  */
-export const listJobs = (opts) => handleRequest(async (req, ctx) => {
+export const listJobs = (protocol, opts) => handlers().request(protocol, async (req, ctx) => {
     const resource = jobsOf(ctx, opts);
-    const viewer = await jobViewer(req, ctx, opts);
+    const audience = await opts.policy.audience(req, ctx);
     const query = (req.query ?? {});
-    const where = {
-        ...jobScope(viewer, opts),
-        ...(query.state != null ? { state: query.state } : {}),
-        ...(query.name != null ? { name: query.name } : {}),
-    };
-    return await resource.list(where, {
-        sort: [{ field: DEFAULT_JOB_SORT, order: 'desc' }],
+    const listed = await resource.list(opts.policy.where(audience, query), {
+        sort: [{ field: 'createdAt', order: 'desc' }],
         ...(query.size != null ? { size: query.size, page: query.page ?? 0 } : {}),
     });
+    return {
+        ...listed,
+        items: await Promise.all(listed.items.map(record => opts.policy.map(record, audience))),
+    };
 });
 //# sourceMappingURL=list.js.map

package/build/actions/list.js.map

@@ -1 +1 @@
-{"version":3,"file":"list.js","sourceRoot":"","sources":["../../src/actions/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAMpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAE/C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAE/D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,IAAwB,EACuB,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACnF,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAClC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IAC9C,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAiB,CAAA;IAE/C,MAAM,KAAK,GAAwB;QACjC,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;QACzB,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAA;IAED,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE;QAChC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAClD,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../src/actions/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAI/C,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAE1C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,QAAgC,EAChC,IAAuB,EACsC,EAAE,CAAC,QAAQ,EAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACzH,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAClC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IACrD,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAiB,CAAA;IAC/C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE;QACrE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAC7C,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC,CAAA;IACF,OAAO;QACL,GAAG,MAAM;QACT,KAAK,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;KAC1D,CAAA;AACjC,CAAC,CAAC,CAAA"}

package/build/actions/watch.d.ts

@@ -1,11 +1,10 @@
-import type { AbstractResponse } from '@owlmeans/entrypoint';
-import type { RefedEntrypointHandler } from '@owlmeans/server-entrypoint';
-import type { JobHandlerOptions } from '../types.js';
+import { connection } from '@owlmeans/server-socket';
+import type { JobEntrypoints, JobHandlerOptions } from '../types.js';
 /**
  * Push this caller's job lifecycle events down a socket.
  *
- * The frames are `JobEvent`s exactly as the queue publishes them, under the {@link JOB_EVENT}
- * event name — no shape of this package's own, so a client applies them with the contract types.
+ * Broker events are resolved inside the caller's audience and mapped to {@link JobViewEvent}; raw
+ * queue ids, payloads, failures and ownership fields never cross the socket boundary.
  *
  * **A `JobEvent` carries no owner**, so each one is attributed by reading its job back, and the
  * ids that answered are remembered for the life of the connection. A queue configured with
@@ -13,5 +12,5 @@ import type { JobHandlerOptions } from '../types.js';
  * attributed by is gone by the time the event arrives, and an unattributable event is dropped
  * rather than fanned out to everyone. Leave completed jobs in place on any queue that is watched.
  */
-export declare const watchJobs: (opts?: JobHandlerOptions) => RefedEntrypointHandler<AbstractResponse<any>>;
+export declare const watchJobs: (protocol: JobEntrypoints['watch'], opts: JobHandlerOptions) => ReturnType<typeof connection>;
 //# sourceMappingURL=watch.d.ts.map

package/build/actions/watch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"watch.d.ts","sourceRoot":"","sources":["../../src/actions/watch.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAKzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAGpD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,SAAS,UACb,iBAAiB,KACvB,sBAAsB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAyC7C,CAAA"}
+{"version":3,"file":"watch.d.ts","sourceRoot":"","sources":["../../src/actions/watch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAMpD,OAAO,KAAK,EAAW,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAG7E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,SAAS,aACV,cAAc,CAAC,OAAO,CAAC,QAC3B,iBAAiB,KACtB,UAAU,CAAC,OAAO,UAAU,CAwC7B,CAAA"}