@cosmicdrift/kumiko-bundled-features 0.155.1 → 0.156.1

package/src/jobs/__tests__/jobs-events.integration.test.ts

@@ -32,12 +32,13 @@ import { jobRunLogsTable, jobRunsTable } from "../job-run-table";
 
 let testDb: TestDb;
 let testRedis: TestRedis;
+let registry: ReturnType<typeof createRegistry>;
 let logger: ReturnType<typeof createJobRunLogger>;
 
 beforeAll(async () => {
   testDb = await createTestDb();
   testRedis = await createTestRedis();
-  const registry = createRegistry([createJobsFeature()]);
+  registry = createRegistry([createJobsFeature()]);
   await unsafePushTables(testDb.db, { jobRunsTable, jobRunLogsTable });
   await createEventsTable(testDb.db);
   logger = createJobRunLogger({ db: testDb.db, registry });
@@ -127,4 +128,39 @@ describe("jobRun event shapes", () => {
     const ids = new Set(events.map((e) => e.aggregateId));
     expect(ids.size).toBe(1);
   });
+
+  test("complete/fail without a prior start skips — does not forge a jobRun stream", async () => {
+    // State-loss path: worker restart with empty cache AND no projection row for
+    // this bullJobId. Dropping the terminal event is intentional — forging an
+    // aggregate from scratch would invent a run that never started.
+    await logger.onJobComplete?.("example:job:orphan", "bull-orphan-complete", 50, []);
+    await logger.onJobFailed?.("example:job:orphan", "bull-orphan-failed", "boom", []);
+
+    const completed = await selectMany(testDb.db, eventsTable, { type: JOB_RUN_COMPLETED_EVENT });
+    const failed = await selectMany(testDb.db, eventsTable, { type: JOB_RUN_FAILED_EVENT });
+    const runs = await selectMany(testDb.db, jobRunsTable);
+
+    expect(completed).toHaveLength(0);
+    expect(failed).toHaveLength(0);
+    expect(runs).toHaveLength(0);
+  });
+
+  test("complete after cache loss recovers runId from the projection (same stream)", async () => {
+    // Simulates worker process restart: in-memory bullJobId→runId cache is gone,
+    // but the run-started projection row still has bull_job_id. A fresh logger
+    // must DB-lookup and append onto the original aggregate — not mint a second.
+    await logger.onJobStart?.("example:job:restart", "bull-restart-1", {});
+    const started = await selectMany(testDb.db, eventsTable, { type: JOB_RUN_STARTED_EVENT });
+    expect(started).toHaveLength(1);
+    const originalAggregateId = started[0]?.aggregateId;
+    expect(originalAggregateId).toBeTruthy();
+
+    const coldLogger = createJobRunLogger({ db: testDb.db, registry });
+    await coldLogger.onJobComplete?.("example:job:restart", "bull-restart-1", 42, []);
+
+    const all = await selectMany(testDb.db, eventsTable, { aggregateType: "jobRun" });
+    expect(all).toHaveLength(2);
+    expect(new Set(all.map((e) => e.aggregateId))).toEqual(new Set([originalAggregateId]));
+    expect(all.some((e) => e.type === JOB_RUN_COMPLETED_EVENT)).toBe(true);
+  });
 });

package/src/jobs/feature.ts

@@ -38,7 +38,7 @@ export function createJobsFeature(): FeatureDefinition {
       recommended: false,
     });
     r.systemScope();
-    r.unmanagedTable(jobRunLogsTableMeta, {
+    r.rawTable(jobRunLogsTableMeta, {
       reason: "read_side.job_run_logs",
     });
     // Events-only aggregate: "jobRun" has no r.entity registration, because

package/src/legal-pages/feature.ts

@@ -50,7 +50,7 @@ export type LegalPagesWrapLayout = (opts: {
   readonly title: string;
   readonly bodyHtml: string;
   readonly lang: string;
-  readonly slug?: "imprint" | "privacy" | "terms";
+  readonly slug?: (typeof LEGAL_ROUTES)[number]["slug"];
 }) => string;
 
 export type LegalPagesOptions = {

package/src/mail-foundation/__tests__/feature.test.ts

@@ -28,7 +28,7 @@ describe("mailFoundationFeature — shape", () => {
 });
 
 describe("mailFoundationFeature.exports — typed handles", () => {
-  test("exposes only the provider-selector config-key", () => {
+  test("exposes the provider-selector handle", () => {
     expect(mailFoundationFeature.exports.providerConfigKey).toBeDefined();
     expect(mailFoundationFeature.exports.providerConfigKey.name).toBe(
       "mail-foundation:config:provider",

package/src/page-render/branding.ts

@@ -73,6 +73,7 @@ export function brandingStyleBlock(tokens: BrandingTokens): string {
     decls.push(`--accent:${tokens.accentColor}`);
   }
   decls.push(`--page-max-width:${layoutMaxWidth(tokens.layoutPreset)}`);
+  // html-ok: decls are CSS custom-property declarations (regex-validated hex color or fixed table lookup), never raw user text.
   return `<style id="tenant-theme">:root{${decls.join(";")}}</style>`;
 }
 
@@ -91,9 +92,9 @@ export function brandingHeaderHtml(tokens: BrandingTokens): string {
   }
   if (parts.length === 0) return "";
 
-  const inner = parts.join("\n");
+  const innerHtml = parts.join("\n");
   if (isSafeHttpsUrl(tokens.siteUrl)) {
-    return `<header class="brand-header"><a href="${escapeHtmlAttr(tokens.siteUrl)}">${inner}</a></header>`;
+    return `<header class="brand-header"><a href="${escapeHtmlAttr(tokens.siteUrl)}">${innerHtml}</a></header>`;
   }
-  return `<header class="brand-header">${inner}</header>`;
+  return `<header class="brand-header">${innerHtml}</header>`;
 }

package/src/personal-access-tokens/feature.ts

@@ -53,7 +53,7 @@ export function createPersonalAccessTokensFeature(
     // Direct-write store like read_user_sessions: create/revoke write it, the
     // resolver point-reads it. r.entity would make it a rebuildable projection
     // whose replay (no token events) would wipe every live token (#498/#494).
-    r.unmanagedTable(buildEntityTableMeta("api-token", apiTokenEntity), {
+    r.rawTable(buildEntityTableMeta("api-token", apiTokenEntity), {
       reason: "read_side.api_tokens_direct_write",
       // create.write encrypts `name` via encryptForDirectWrite (#820).
       piiEncryptedOnWrite: true,

package/src/sessions/__tests__/sessions.integration.test.ts

@@ -391,6 +391,41 @@ describe("sessions feature — login → check → revoke → rejected", () => {
     expect(body.error?.details?.reason).toBe("missing");
   });
 
+  // Cross-user check: a valid JWT for Alice paired with Bob's live sid must
+  // look identical to a forged/missing sid — otherwise the checker would be
+  // an existence oracle on other users' sessions.
+  test("sid belonging to another user → 401 reason=missing (no existence oracle)", async () => {
+    const alice = await h.seedUser("alice-xuser@example.com", "pw-long-enough");
+    const bob = await h.seedUser("bob-xuser@example.com", "pw-long-enough");
+    const bobLogin = await h.login("bob-xuser@example.com", "pw-long-enough");
+
+    // Direct invariant: Bob's sid + Alice's userId → missing (not live/revoked).
+    expect(await callbacks.get().sessionChecker(bobLogin.sid, alice.userId)).toBe("missing");
+    expect(await callbacks.get().sessionChecker(bobLogin.sid, bob.userId)).toBe("live");
+
+    // HTTP path: mint Alice's identity onto Bob's sid (stolen-sid scenario).
+    const forged = await stack.jwt.sign({
+      id: alice.userId,
+      tenantId: TENANT,
+      roles: ["User"],
+      sid: bobLogin.sid,
+    });
+    const res = await h.authedPost("/api/query", forged, {
+      type: "user:query:user:me",
+      payload: {},
+    });
+    expect(res.status).toBe(401);
+    const body = (await res.json()) as { error?: { details?: { reason?: string } } };
+    expect(body.error?.details?.reason).toBe("missing");
+
+    // Control: Bob's own JWT still authenticates — the sid itself is fine.
+    const bobOk = await h.authedPost("/api/query", bobLogin.token, {
+      type: "user:query:user:me",
+      payload: {},
+    });
+    expect(bobOk.status).toBe(200);
+  });
+
   test("expired session row → 401 with reason=expired", async () => {
     await h.seedUser("stale@example.com", "pw-long-enough");
     const { token, sid } = await h.login("stale@example.com", "pw-long-enough");
@@ -511,6 +546,48 @@ describe("sessions feature — login → check → revoke → rejected", () => {
     });
     expect(asUser.status).toBe(403);
   });
+
+  // IDOR guard: session:detail/session:list are scoped by ctx.db (TenantDb)
+  // alone, no explicit tenant predicate in the handler — an admin from a
+  // different tenant must not be able to read another tenant's session rows.
+  test("session:detail and session:list never leak sessions across tenants", async () => {
+    const TENANT_2 = testTenantId(2);
+    const h2 = makeSessionHelpers(stack, TENANT_2);
+
+    const { userId: carolId } = await h.seedUser("carol4@example.com", "pw-long-enough");
+    await updateRows(
+      stack.db,
+      tenantMembershipsTable,
+      { roles: JSON.stringify(["Admin"]) },
+      { userId: carolId, tenantId: TENANT },
+    );
+    const carolAsAdmin = await h.login("carol4@example.com", "pw-long-enough");
+
+    const { userId: daveId } = await h2.seedUser("dave4@example.com", "pw-long-enough");
+    await updateRows(
+      stack.db,
+      tenantMembershipsTable,
+      { roles: JSON.stringify(["Admin"]) },
+      { userId: daveId, tenantId: TENANT_2 },
+    );
+    const daveAsAdmin = await h2.login("dave4@example.com", "pw-long-enough");
+
+    const detailRes = await h2.authedPost("/api/query", daveAsAdmin.token, {
+      type: SessionQueries.detail,
+      payload: { id: carolAsAdmin.sid },
+    });
+    expect(detailRes.status).toBe(200);
+    const detailBody = (await detailRes.json()) as { data: unknown };
+    expect(detailBody.data).toBeNull();
+
+    const listRes = await h2.authedPost("/api/query", daveAsAdmin.token, {
+      type: SessionQueries.list,
+      payload: {},
+    });
+    expect(listRes.status).toBe(200);
+    const listBody = (await listRes.json()) as { data: Array<{ id: string }> };
+    expect(listBody.data.map((r) => r.id)).not.toContain(carolAsAdmin.sid);
+  });
 });
 
 // Defense-in-depth: the sessionChecker refuses a live sid once the user it

package/src/sessions/feature.ts

@@ -93,10 +93,10 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
     // r.entity would make it a rebuildable implicit projection whose replay
     // finds zero session events and swaps an empty shadow over the live
     // table — wiping every active session on the next projection rebuild
-    // (#498/#494). r.unmanagedTable keeps the migration DDL but opts the
+    // (#498/#494). r.rawTable keeps the migration DDL but opts the
     // table out of implicit rebuild, like jobs/channel-in-app/feature-toggles
     // which are direct-write stores too.
-    r.unmanagedTable(buildEntityTableMeta("user-session", userSessionEntity), {
+    r.rawTable(buildEntityTableMeta("user-session", userSessionEntity), {
       reason: "read_side.user_sessions_direct_write",
       // sessionCreator encrypts ip/userAgent via encryptForDirectWrite (#820).
       piiEncryptedOnWrite: true,

package/src/sessions/session-checker-fail-open.test.ts

@@ -0,0 +1,77 @@
+import { describe, expect, spyOn, test } from "bun:test";
+import * as bunDb from "@cosmicdrift/kumiko-framework/bun-db";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { Temporal } from "temporal-polyfill";
+import { USER_STATUS, userTable } from "../user/schema/user";
+import { userSessionTable } from "./schema/user-session";
+import { createSessionCallbacks } from "./session-callbacks";
+
+// Unit-only: the fail-open-on-throw branch cannot be provoked through real
+// Postgres without faking infrastructure failure. Integration tests forbid
+// mocks, so this lives next to the source as a plain *.test.ts.
+
+type FetchOne = typeof bunDb.fetchOne;
+
+describe("sessionChecker fail-open on user-lookup throw", () => {
+  test("read_users THROW → live (not 500 / not blocked)", async () => {
+    const db = {} as DbConnection;
+    const cbs = createSessionCallbacks({ db });
+    const sid = "00000000-0000-4000-8000-00000000sid1";
+    const userId = "00000000-0000-4000-8000-00000000user";
+    const farFutureMs = Temporal.Now.instant().add({ hours: 1 }).epochMilliseconds;
+
+    const originalFetchOne = bunDb.fetchOne;
+    const spy = spyOn(bunDb, "fetchOne").mockImplementation((async (_db, table) => {
+      if (table === userSessionTable) {
+        return {
+          userId,
+          revokedAt: null,
+          expiresAt: { epochMilliseconds: farFutureMs },
+        };
+      }
+      if (table === userTable) {
+        throw new Error("simulated pool exhaustion");
+      }
+      throw new Error("unexpected table in sessionChecker spy");
+    }) as FetchOne);
+
+    try {
+      expect(await cbs.sessionChecker(sid, userId)).toBe("live");
+    } finally {
+      spy.mockRestore();
+      // Sanity: restore must put the real export back (guards against spy leak).
+      expect(bunDb.fetchOne).toBe(originalFetchOne);
+    }
+  });
+
+  test("control: Restricted user without throw → blocked (spy must hit userTable)", async () => {
+    // If the spy somehow skipped the userTable branch, Restricted would still
+    // be "live" via fail-open-on-null — this control pins that the throw path
+    // is what we exercise above, not an accidental miss.
+    const db = {} as DbConnection;
+    const cbs = createSessionCallbacks({ db });
+    const sid = "00000000-0000-4000-8000-00000000sid2";
+    const userId = "00000000-0000-4000-8000-00000000usr2";
+    const farFutureMs = Temporal.Now.instant().add({ hours: 1 }).epochMilliseconds;
+
+    const spy = spyOn(bunDb, "fetchOne").mockImplementation((async (_db, table) => {
+      if (table === userSessionTable) {
+        return {
+          userId,
+          revokedAt: null,
+          expiresAt: { epochMilliseconds: farFutureMs },
+        };
+      }
+      if (table === userTable) {
+        return { status: USER_STATUS.Restricted };
+      }
+      throw new Error("unexpected table in sessionChecker spy");
+    }) as FetchOne);
+
+    try {
+      expect(await cbs.sessionChecker(sid, userId)).toBe("blocked");
+    } finally {
+      spy.mockRestore();
+    }
+  });
+});

package/src/user-data-rights/handlers/download-by-job.query.ts

@@ -25,12 +25,16 @@
 
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  defineQueryHandler,
+  SYSTEM_USER_ID,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { z } from "zod";
 import { recordDownloadUse, recordInvalidAttempt } from "../audit-download";
-import { resolveTenantFileProvider } from "../lib/tenant-file-provider";
+import { makeTenantStorageProviderResolver } from "../lib/storage-provider-resolver";
 import { exportDownloadTokensTable } from "../schema/download-token";
 import { EXPORT_JOB_STATUS, exportJobsTable } from "../schema/export-job";
 
@@ -130,11 +134,14 @@ export const downloadByJobQuery = defineQueryHandler({
     // Provider bound explicitly to the job's tenant — NOT the ambient
     // session tenant (cross-tenant-same-user: job.requestedFromTenantId
     // can differ from query.user.tenantId).
-    const provider = await resolveTenantFileProvider(
-      ctx,
-      jobRow.requestedFromTenantId,
-      "user-data-rights:query:download-by-job",
-    );
+    const provider = await makeTenantStorageProviderResolver({
+      registry: ctx.registry,
+      configResolver: ctx.configResolver,
+      secrets: ctx.secrets,
+      db: ctx.db.raw,
+      userId: SYSTEM_USER_ID,
+      handlerName: "user-data-rights:query:download-by-job",
+    })(jobRow.requestedFromTenantId as TenantId); // @cast-boundary engine-payload: TenantId brand
     if (!provider.getSignedUrl) {
       await recordInvalidAttempt({
         db: ctx.db.raw,

package/src/user-data-rights/handlers/download-by-token.query.ts

@@ -27,12 +27,16 @@
 // startet. Dieser query-handler liefert nur das JSON.
 
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  defineQueryHandler,
+  SYSTEM_USER_ID,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { z } from "zod";
 import { recordDownloadUse, recordInvalidAttempt } from "../audit-download";
-import { resolveTenantFileProvider } from "../lib/tenant-file-provider";
+import { makeTenantStorageProviderResolver } from "../lib/storage-provider-resolver";
 import { exportDownloadTokensTable } from "../schema/download-token";
 import { EXPORT_JOB_STATUS, exportJobsTable } from "../schema/export-job";
 import { hashDownloadToken } from "../token-helpers";
@@ -184,11 +188,14 @@ export const downloadByTokenQuery = defineQueryHandler({
     // Step 5: signed-URL via provider, explicitly bound to the job's
     // tenant — NOT the ambient request tenant (anonymous magic-link path
     // has none under resolverTrust: "authoritative").
-    const provider = await resolveTenantFileProvider(
-      ctx,
-      jobRow.requestedFromTenantId,
-      "user-data-rights:query:download-by-token",
-    );
+    const provider = await makeTenantStorageProviderResolver({
+      registry: ctx.registry,
+      configResolver: ctx.configResolver,
+      secrets: ctx.secrets,
+      db: ctx.db.raw,
+      userId: SYSTEM_USER_ID,
+      handlerName: "user-data-rights:query:download-by-token",
+    })(jobRow.requestedFromTenantId as TenantId); // @cast-boundary engine-payload: TenantId brand
     if (!provider.getSignedUrl) {
       await recordInvalidAttempt({
         db: ctx.db.raw,

package/src/user-data-rights/lib/storage-provider-resolver.ts

@@ -4,8 +4,9 @@
 // construction). Extracted from the export cron so both crons + the manual
 // forget handler share one construction site instead of inlining it three times.
 
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { DbConnection, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { ConfigResolver, Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import type { FileStorageProvider } from "@cosmicdrift/kumiko-framework/files";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import { createConfigAccessor } from "../../config";
@@ -18,7 +19,7 @@ export interface TenantStorageResolverCtx {
   // Undefined → the returned resolver throws (callers decide fail-loud vs skip).
   readonly configResolver: ConfigResolver | undefined;
   readonly secrets: SecretsContext | undefined;
-  readonly db: DbConnection;
+  readonly db: DbConnection | TenantDb;
   readonly userId: string;
   readonly handlerName: string;
 }
@@ -28,9 +29,9 @@ export function makeTenantStorageProviderResolver(
 ): (tenantId: TenantId) => Promise<FileStorageProvider> {
   return async (tenantId) => {
     if (!ctx.configResolver) {
-      throw new Error(
-        `${ctx.handlerName}: ctx.configResolver missing — cannot resolve the file provider for tenant ${tenantId}`,
-      );
+      throw new InternalError({
+        message: `[${ctx.handlerName}] ctx.configResolver missing — cannot resolve the file provider for tenant ${tenantId}`,
+      });
     }
     const config = createConfigAccessor(
       ctx.registry,

package/src/user-profile/__tests__/change-email.integration.test.ts

@@ -26,6 +26,7 @@ import {
 import { createConfigFeature } from "../../config";
 import { configValuesTable } from "../../config/table";
 import { createDataRetentionFeature } from "../../data-retention";
+import { createFilesFeature } from "../../files";
 import { createSessionsFeature } from "../../sessions";
 import { hashPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant";
@@ -36,6 +37,7 @@ import { UserErrors, UserHandlers, UserQueries } from "../../user";
 import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { createUserDataRightsFeature } from "../../user-data-rights";
+import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults";
 import {
   UserDataRightsHandlers,
   UserProfileErrors,
@@ -59,7 +61,9 @@ beforeAll(async () => {
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
       createSessionsFeature(),
+      createFilesFeature(),
       createUserDataRightsFeature(),
+      createUserDataRightsDefaultsFeature(),
       createUserProfileFeature(),
     ],
     authConfig: {

package/src/user-profile/feature.ts

@@ -11,7 +11,9 @@ export function createUserProfileFeature(): FeatureDefinition {
         "change-email and account deletion (user-data-rights request/cancel with " +
         "grace period) into one screen. Apps register the screen as " +
         '`type: "custom"` with `__component: "UserProfileScreen"`. Requires `user`, ' +
-        "`auth-email-password`, and `user-data-rights`.",
+        "`auth-email-password`, `user-data-rights`, and `user-data-rights-defaults` " +
+        "(so the GDPR boot-validator finds export/delete hooks for `user`'s PII " +
+        "fields once user-data-rights is mounted).",
     );
     r.uiHints({
       displayLabel: "User Profile · Self-Service",
@@ -21,6 +23,7 @@ export function createUserProfileFeature(): FeatureDefinition {
     r.requires("user");
     r.requires("auth-email-password");
     r.requires("user-data-rights");
+    r.requires("user-data-rights-defaults");
 
     const handlers = {
       changeEmail: r.writeHandler(changeEmailWrite),

package/src/user-data-rights/lib/tenant-file-provider.ts

@@ -1,62 +0,0 @@
-// Resolves the GDPR-download file-storage provider explicitly for
-// `jobRow.requestedFromTenantId` instead of the ambient request tenant.
-//
-// Both download handlers (by-token, by-job) used to call
-// `createFileProviderForTenant(ctx, jobRow.requestedFromTenantId, ...)`,
-// which reads the PROVIDER SELECTION from `ctx.config` — bound to the
-// caller's own ambient tenant, not the job's tenant:
-//   - by-token (anonymous magic-link, httpRoute): under
-//     `resolverTrust: "authoritative"` without `defaultTenantId` there is
-//     no ambient tenant at all — `ctx.config` throws, 500s the whole
-//     GDPR download flow.
-//   - by-job (session-authed): a user can own jobs across tenants
-//     (cross-tenant-same-user); the ambient session tenant silently
-//     picks the WRONG tenant's provider config for a job requested from
-//     a different tenant.
-//
-// Fix: build a fresh config accessor bound explicitly to the given
-// tenantId (same construction as `makeTenantStorageProviderResolver`,
-// which the export/forget crons already use), instead of the ambient
-// `ctx.config`. Deliberately NOT `ctx._fileProviderResolver` — that
-// resolver is boot-built and per-tenant-cached for the process lifetime,
-// so an operator switching `file-foundation:config:provider` mid-session
-// wouldn't take effect until the cache evicts.
-import type { DbConnection, TenantDb } from "@cosmicdrift/kumiko-framework/db";
-import type { ConfigResolver, Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { SYSTEM_USER_ID } from "@cosmicdrift/kumiko-framework/engine";
-import type { FileStorageProvider } from "@cosmicdrift/kumiko-framework/files";
-import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
-import { createConfigAccessor } from "../../config";
-import { createFileProviderForTenant } from "../../file-foundation";
-
-export interface TenantFileProviderCtx {
-  readonly registry?: Registry;
-  readonly configResolver?: ConfigResolver;
-  readonly secrets?: SecretsContext;
-  readonly db: { readonly raw: DbConnection | TenantDb };
-}
-
-export async function resolveTenantFileProvider(
-  ctx: TenantFileProviderCtx,
-  tenantId: string,
-  handlerName: string,
-): Promise<FileStorageProvider> {
-  if (!ctx.registry || !ctx.configResolver) {
-    throw new Error(
-      `${handlerName}: ctx.registry/ctx.configResolver missing — cannot resolve the file provider for tenant ${tenantId}`,
-    );
-  }
-  const config = createConfigAccessor(
-    ctx.registry,
-    ctx.configResolver,
-    tenantId as TenantId, // @cast-boundary engine-payload: TenantId brand
-    SYSTEM_USER_ID,
-    ctx.db.raw,
-    ctx.secrets,
-  );
-  return createFileProviderForTenant(
-    { config, registry: ctx.registry, secrets: ctx.secrets, _userId: SYSTEM_USER_ID },
-    tenantId,
-    handlerName,
-  );
-}