@cosmicdrift/kumiko-bundled-features 0.265.0 → 0.268.0

package/src/sessions/handlers/revoke-all-for-user.write.ts

@@ -13,6 +13,9 @@ import {
   sessionRevokedSchema,
 } from "../session-revoked-event";
 
+const REVOKE_ALL_SESSIONS_REASON =
+  "revokes the target user's sessions in every tenant and appends the audit event on the SYSTEM stream";
+
 // Mass-revoke ALL live sessions for a target user — privileged-only.
 // Used by user-data-rights:restrict-account for account-freeze (DSGVO
 // Art. 18) and potentially other ops flows ("ban user", "compromised
@@ -37,9 +40,13 @@ export const revokeAllForUserWrite = defineWriteHandler({
   description:
     "Irreversibly signs a named user out of all their live sessions, across every tenant unless a tenantId narrows it; use it for operator actions such as freezing or banning an account.",
   agent: { risk: "high" },
+  escapeHatch: {
+    reason: REVOKE_ALL_SESSIONS_REASON,
+  },
   handler: async (event, ctx) => {
+    const runner = ctx.db.unsafeRaw(REVOKE_ALL_SESSIONS_REASON);
     const updated = await updateMany<{ id: string }>(
-      ctx.db.raw,
+      runner,
       userSessionTable,
       { revokedAt: Temporal.Now.instant() },
       {
@@ -79,7 +86,7 @@ export const revokeAllForUserWrite = defineWriteHandler({
         sessionIds: updated.map((row) => row.id),
       });
       const reqCtx = requestContext.get();
-      await append(ctx.db.raw, {
+      await append(runner, {
         aggregateId: generateId(),
         aggregateType: SESSION_REVOKED_AGGREGATE_TYPE,
         tenantId: SYSTEM_TENANT_ID,

package/src/tenant-lifecycle/handlers/cancel-destruction.write.ts

@@ -15,15 +15,25 @@ type TenantLifecycleRow = {
   gracePeriodEnd: Temporal.Instant | null;
 };
 
+const CANCEL_DESTRUCTION_TENANT_ROW_REASON =
+  "reads the caller's tenant row, whose tenant_id is the creating tenant, not the row's own id";
+
 export const cancelDestructionWrite = defineWriteHandler({
   name: "cancel-destruction",
   schema: z.object({}),
   access: { roles: ["TenantOwner", "Admin"] },
   description:
     "Returns a tenant whose destruction was requested back to active and clears the grace period; use it to undo a close-account request while the grace period is still running.",
+  escapeHatch: {
+    reason: CANCEL_DESTRUCTION_TENANT_ROW_REASON,
+  },
   handler: async (event, ctx) => {
     const tenantId = event.user.tenantId;
-    const row = await fetchOne<TenantLifecycleRow>(ctx.db.raw, tenantTable, { id: tenantId });
+    const row = await fetchOne<TenantLifecycleRow>(
+      ctx.db.unsafeRaw(CANCEL_DESTRUCTION_TENANT_ROW_REASON),
+      tenantTable,
+      { id: tenantId },
+    );
     if (!row) {
       return writeFailure(new UnprocessableError("tenant_not_found", { details: { tenantId } }));
     }

package/src/tenant-lifecycle/handlers/request-destruction.write.ts

@@ -18,6 +18,9 @@ type TenantLifecycleRow = {
   gracePeriodEnd: Temporal.Instant | null;
 };
 
+const REQUEST_DESTRUCTION_TENANT_ROW_REASON =
+  "reads the caller's tenant row, whose tenant_id is the creating tenant, its compliance profile, and revokes its sessions via DbRunner helpers";
+
 export const requestDestructionWrite = defineWriteHandler({
   name: "request-destruction",
   schema: z.object({}),
@@ -25,9 +28,13 @@ export const requestDestructionWrite = defineWriteHandler({
   description:
     "Puts the caller's own tenant into destroyRequested, starts the compliance-profile grace period after which its data is erased, and revokes every session in the tenant; use it when an account owner asks to close their account.",
   agent: { risk: "high" },
+  escapeHatch: {
+    reason: REQUEST_DESTRUCTION_TENANT_ROW_REASON,
+  },
   handler: async (event, ctx) => {
     const tenantId = event.user.tenantId;
-    const row = await fetchOne<TenantLifecycleRow>(ctx.db.raw, tenantTable, { id: tenantId });
+    const runner = ctx.db.unsafeRaw(REQUEST_DESTRUCTION_TENANT_ROW_REASON);
+    const row = await fetchOne<TenantLifecycleRow>(runner, tenantTable, { id: tenantId });
     if (!row) {
       return writeFailure(new UnprocessableError("tenant_not_found", { details: { tenantId } }));
     }
@@ -39,7 +46,7 @@ export const requestDestructionWrite = defineWriteHandler({
       );
     }
 
-    const { profile } = await resolveProfileForTenant({ db: ctx.db.raw, tenantId });
+    const { profile } = await resolveProfileForTenant({ db: runner, tenantId });
     const T = getTemporal();
     const gracePeriodEnd = addDurationSpec(T.Now.instant(), profile.tenantDestroyGracePeriod);
 
@@ -71,7 +78,7 @@ export const requestDestructionWrite = defineWriteHandler({
     });
 
     if (await ctx.hasFeature("sessions")) {
-      await revokeTenantSessions(ctx.db.raw, tenantId);
+      await revokeTenantSessions(runner, tenantId);
     }
 
     return {

package/src/tier-engine/feature.ts

@@ -46,7 +46,6 @@ import {
   buildEntityTable,
   createEventStoreExecutor,
   createTenantDb,
-  type DbConnection,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
   defineEntityCreateHandler,
@@ -373,6 +372,8 @@ export function createTierEngineFeature<
     // neuer Tenant (Memory `feedback_event_store_tenant_consistency`).
     if (opts.defaultTier !== undefined) {
       const defaultTier = opts.defaultTier;
+      const autoDefaultTierHookReason =
+        "seeds the default tier-assignment stream of the tenant just created";
       r.hook(
         "postSave",
         { allOf: "tenant" },
@@ -392,26 +393,17 @@ export function createTierEngineFeature<
 
           // tenant is an r.systemScope() feature, so this cross-feature hook gets a
           // fail-closed ctx.db — reach for ctx.systemDb instead (see entity-handlers.ts).
-          const db = ctx.systemDb
-            ? ctx.systemDb.acknowledgeCrossTenant(
-                `tier-engine auto-default-tier hook on r.systemScope() tenant write (${newTenantId})`,
-              )
-            : ctx.db;
+          // Event-store paths need the raw DbConnection — TenantDb only exposes
+          // select/insert/update/delete, not execute (db.execute(sql`SELECT pg_notify(...)`) would TypeError).
+          const rawDb = ctx.systemDb
+            ? ctx.systemDb.unsafeRaw(autoDefaultTierHookReason)
+            : ctx.db && "unsafeRaw" in ctx.db
+              ? ctx.db.unsafeRaw(autoDefaultTierHookReason)
+              : undefined;
           // skip: defensive — inTransaction phase always sets db, but AppContext's
           // type makes it optional. Throwing would be overreach (lifecycle
           // blocking), silent-skip is defensive-soft.
-          if (!db) return;
-
-          // db is a TenantDb in the inTransaction phase (tenant-scoped proxy over
-          // the real tx). Event-store paths need the raw DbConnection — TenantDb
-          // only exposes select/insert/update/delete, not execute
-          // (event-store-append.ts:102 calls db.execute(sql`SELECT pg_notify(...)`)
-          // → TypeError otherwise). Pattern matches signup-confirm.write.ts:107
-          // (.raw), not `as DbConnection` — that's a type-lie that only crashes on
-          // the first .execute() call.
-          // skip: defensive — should never trip in the inTransaction phase.
-          if (!("raw" in db)) return;
-          const rawDb = db.raw as DbConnection; // @cast-boundary db-runner
+          if (!rawDb) return;
 
           // Idempotency: stream-existence-check vor create. Pattern aus
           // seedTenant.ts. Bei re-replay (rebuild) nicht versionsbumpen.
@@ -438,7 +430,7 @@ export function createTierEngineFeature<
             tdb,
           );
         },
-        { phase: HookPhases.inTransaction },
+        { phase: HookPhases.inTransaction, escapeHatch: { reason: autoDefaultTierHookReason } },
       );
     }
 

package/src/tier-engine/handlers/get-tenant-tier.query.ts

@@ -1,9 +1,5 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import {
-  buildEntityTable,
-  createTenantDb,
-  type DbConnection,
-} from "@cosmicdrift/kumiko-framework/db";
+import { buildEntityTable, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
 import { type TierAssignmentRow, tierAssignmentEntity } from "../entity";
@@ -15,15 +11,20 @@ import { type TierAssignmentRow, tierAssignmentEntity } from "../entity";
 
 const tierAssignmentTable = buildEntityTable("tier-assignment", tierAssignmentEntity);
 
+const GET_TENANT_TIER_REASON = "SystemAdmin reads the tier of the tenant named in the payload";
+
 export const getTenantTierQuery = defineQueryHandler({
   name: "get-tenant-tier",
   description:
     "Returns the tier-assignment of any given tenant including where it came from (manual grant, billing sync or signup default), or null; use it to look up another tenant's plan.",
   schema: z.object({ tenantId: z.string().min(1) }),
   access: { roles: ["SystemAdmin"] },
+  escapeHatch: {
+    reason: GET_TENANT_TIER_REASON,
+  },
   handler: async (query, ctx) => {
     const tenantId = query.payload.tenantId as TenantId; // @cast-boundary engine-bridge
-    const tdb = createTenantDb(ctx.db.raw as DbConnection, tenantId, "system"); // @cast-boundary db-runner
+    const tdb = createTenantDb(ctx.db.unsafeRaw(GET_TENANT_TIER_REASON), tenantId, "system");
     const row = await fetchOne<TierAssignmentRow>(tdb, tierAssignmentTable, { tenantId });
     return row ?? null;
   },

package/src/tier-engine/handlers/set-tenant-tier.write.ts

@@ -3,7 +3,6 @@ import {
   buildEntityTable,
   createEventStoreExecutor,
   createTenantDb,
-  type DbConnection,
 } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
@@ -39,6 +38,8 @@ const executor = createEventStoreExecutor(tierAssignmentTable, tierAssignmentEnt
   entityName: "tier-assignment",
 });
 
+const SET_TENANT_TIER_REASON = "SystemAdmin assigns the tier of the tenant named in the payload";
+
 export type SetTenantTierOptions = {
   /** Nach erfolgreichem Write aufgerufen, damit feature.ts den Resolver-
    *  Cache aktualisieren kann (der Executor-Write feuert den postSave-Hook
@@ -66,9 +67,12 @@ export function createSetTenantTierWrite(opts: SetTenantTierOptions = {}) {
         .refine((t) => !opts.validTiers || opts.validTiers.has(t), { message: "unknown tier" }),
     }),
     access: { roles: ["SystemAdmin"] },
+    escapeHatch: {
+      reason: SET_TENANT_TIER_REASON,
+    },
     handler: async (event, ctx) => {
       const tenantId = event.payload.tenantId as TenantId; // @cast-boundary engine-bridge
-      const rawDb = ctx.db.raw as DbConnection; // @cast-boundary db-runner
+      const rawDb = ctx.db.unsafeRaw(SET_TENANT_TIER_REASON);
       const tdb = createTenantDb(rawDb, tenantId, "system");
       const systemUser = { ...event.user, tenantId };
       const tier = event.payload.tier;

package/src/user/__tests__/user-global-tenancy.integration.test.ts

@@ -0,0 +1,97 @@
+// fw#2858 — userEntity carries `tenancy: "global"` (a person's platform-wide
+// identity, shared across tenants). Reads through ctx.db.global(userTable)
+// work cross-tenant with no escapeHatch; a write attempt through the same
+// accessor is denied without one — userTable stays managed (executor-only),
+// so a hand-written write bypassing the executor must still be gated.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { z } from "zod";
+import { UserHandlers } from "../constants";
+import { createUserFeature } from "../feature";
+import { userEntity, userTable } from "../schema/user";
+
+const globalUserAccessFeature = defineFeature("user-global-access-probe", (r) => {
+  r.queryHandler({
+    name: "read-via-global",
+    schema: z.object({ id: z.string() }),
+    access: { roles: ["User"] },
+    handler: async (query, ctx) => {
+      const row = await ctx.db
+        .global(userTable)
+        .fetchOne<{ id: string; email: string }>({ id: query.payload.id });
+      return row ?? null;
+    },
+  });
+
+  r.writeHandler({
+    name: "write-via-global-without-hatch",
+    schema: z.object({}),
+    access: { roles: ["User"] },
+    handler: async (_event, ctx) => {
+      const accessor = ctx.db.global(userTable);
+      // @ts-expect-error executor-only brand — userTable's managed write methods
+      // are type-hidden through db.global(); the runtime object still carries
+      // them, so the escapeHatch gate below is the actual enforcement.
+      const row = await accessor.insertOne({ displayName: "hack", email: "hack@example.com" });
+      return { isSuccess: true as const, data: row };
+    },
+  });
+});
+
+let stack: TestStack;
+const systemAdmin = TestUsers.systemAdmin;
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [createUserFeature(), globalUserAccessFeature] });
+  await unsafeCreateEntityTable(stack.db, userEntity);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+describe("ctx.db.global(userTable) — cross-tenant identity access (fw#2858)", () => {
+  test("a handler in tenant A reads the user via db.global(userTable).fetchOne", async () => {
+    const created = await stack.http.writeOk<{ id: string }>(
+      UserHandlers.create,
+      { email: "global-read@example.com", displayName: "Global Read", passwordHash: "seeded-hash" },
+      systemAdmin,
+    );
+
+    const readerInTenantA = createTestUser({
+      id: crypto.randomUUID(),
+      tenantId: "11111111-0000-4000-8000-0000000000a1",
+      roles: ["User"],
+    });
+    const row = await stack.http.queryOk<{ id: string; email: string } | null>(
+      "user-global-access-probe:query:read-via-global",
+      { id: created.id },
+      readerInTenantA,
+    );
+
+    expect(row?.id).toBe(created.id);
+    expect(row?.email).toBe("global-read@example.com");
+  });
+
+  test("a write attempt through ctx.db.global(userTable) without escapeHatch fails with access_denied", async () => {
+    const writer = createTestUser({
+      id: crypto.randomUUID(),
+      tenantId: "11111111-0000-4000-8000-0000000000a2",
+      roles: ["User"],
+    });
+    const err = await stack.http.writeErr(
+      "user-global-access-probe:write:write-via-global-without-hatch",
+      {},
+      writer,
+    );
+    expect(err.code).toBe("access_denied");
+  });
+});

package/src/user/handlers/update-roles.ts

@@ -2,6 +2,7 @@ import { asEntityTableMeta, asRawClient, fetchOne } from "@cosmicdrift/kumiko-fr
 import {
   acquireNamespacedAdvisoryLock,
   createEventStoreExecutor,
+  type DbRunner,
   type TenantDb,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
@@ -52,13 +53,13 @@ function isActiveSystemAdminRow(row: UserRolesRow): boolean {
   return isActiveUserRow(row) && parseRoles(row.roles).includes("SystemAdmin");
 }
 
-async function countOtherActiveSystemAdmins(db: TenantDb, excludeUserId: string): Promise<number> {
+async function countOtherActiveSystemAdmins(db: DbRunner, excludeUserId: string): Promise<number> {
   const tableName = asEntityTableMeta(userTable)?.tableName;
   if (!tableName) {
     throw new InternalError({ message: "user read table meta missing" });
   }
   // kumiko-lint-ignore raw-sql jsonb @> prefilter for SystemAdmin roster under advisory lock
-  const rows = (await asRawClient(db.raw).unsafe(
+  const rows = (await asRawClient(db).unsafe(
     `SELECT id, roles, status, is_deleted AS "isDeleted"
      FROM ${quoteIdent(tableName)}
      WHERE is_deleted = false
@@ -128,7 +129,17 @@ export async function applyUserRolesUpdate(
     // Lock before count+update so two concurrent demotions cannot both
     // observe otherActiveSystemAdmins >= 1 and leave zero active SystemAdmins.
     await acquireNamespacedAdvisoryLock(db, LAST_SYSTEM_ADMIN_LOCK_NAMESPACE, "global");
-    const otherActiveSystemAdmins = await countOtherActiveSystemAdmins(db, event.payload.id);
+    // user is r.systemScope() — the count spans every tenant's SystemAdmins,
+    // so it needs the raw runner, not the (still tenant-shaped) `db` above.
+    if (!ctx.systemDb) {
+      throw new InternalError({ message: "user:update-roles requires ctx.systemDb" });
+    }
+    const otherActiveSystemAdmins = await countOtherActiveSystemAdmins(
+      ctx.systemDb.unsafeRaw(
+        "jsonb @> prefilter over the global users table to count remaining active SystemAdmins",
+      ),
+      event.payload.id,
+    );
     if (otherActiveSystemAdmins === 0) {
       return writeFailure(
         new ConflictError({

package/src/user/handlers/update.write.ts

@@ -15,6 +15,9 @@ import { applyUserRolesUpdate } from "./update-roles";
 
 const crud = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
 
+const SYSTEM_ADMIN_DEMOTION_COUNT_REASON =
+  "on a SystemAdmin demotion, a jsonb @> prefilter over the global users table counts remaining active SystemAdmins";
+
 // Users can update their OWN profile; SystemAdmin/system can update anyone.
 // Handler-level access is openToAll — the row guard below is the actual gate,
 // and field-level access (passwordHash/email write-locked to "privileged")
@@ -40,9 +43,19 @@ export const updateWrite = defineWriteHandler({
       roles: rolesInputSchema.optional(),
     }),
   }),
-  access: { openToAll: true },
+  access: {
+    openToAll: {
+      reason:
+        "Any signed-in user edits their own profile and privileged actors edit any user; " +
+        "the self-or-privileged check lives in the handler body, not in userEntity.access.write.",
+      personalData: "tenant-members",
+    },
+  },
   description:
     "Changes a user's display name, locale, timezone, email, verification flag, last active tenant or global roles against the version the caller read; callers may edit themselves, while editing someone else or granting roles needs a privileged actor.",
+  escapeHatch: {
+    reason: SYSTEM_ADMIN_DEMOTION_COUNT_REASON,
+  },
   handler: async (event, ctx) => {
     const isSelf = event.payload.id === event.user.id;
     const isPrivileged = hasAccess(event.user, { roles: access.privileged });

package/src/user/principal-status.ts

@@ -1,5 +1,10 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import type { PrincipalStatus, PrincipalStatusPlugin } from "@cosmicdrift/kumiko-framework/engine";
+import type {
+  PrincipalProfile,
+  PrincipalStatus,
+  PrincipalStatusPlugin,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { USER_STATUS, type UserStatus, userTable } from "./schema/user";
 
 // Locked accounts whose live sessions must be refused. deletionRequested is
@@ -23,4 +28,20 @@ export const principalStatusPlugin: PrincipalStatusPlugin = {
     if (!row) return "unknown";
     return isPrincipalBlocked(row.status) ? "blocked" : "active";
   },
+
+  // ctx.queryAsMember's global-roles/timezone/locale source — same fields
+  // login mints a session from (see login.write.ts gateBuildSession).
+  async resolveProfile(userId, { db }): Promise<PrincipalProfile | null> {
+    const row = await fetchOne<{ roles: unknown; timezone: string | null; locale: string | null }>(
+      db,
+      userTable,
+      { id: userId },
+    );
+    if (!row) return null;
+    return {
+      globalRoles: parseRoles(row.roles),
+      ...(row.timezone ? { timezone: row.timezone } : {}),
+      ...(row.locale ? { locale: row.locale } : {}),
+    };
+  },
 };

package/src/user/schema/user.ts

@@ -65,6 +65,9 @@ export const userEntity = createEntity({
   // Tenant-independent identity aggregate — its event stream lives on
   // SYSTEM_TENANT_ID instead of whichever tenant happened to create it (#497).
   systemStream: true,
+  // Every row lives on SYSTEM_TENANT_ID; writes with another tenantId are
+  // rejected (fw#2858).
+  tenancy: "global",
   fields: {
     // Identity — anyone who can see the user can read the email, but only
     // privileged roles (SYSTEM auth code, SystemAdmin) may change it.

package/src/user-data-rights/__tests__/audit-log.integration.test.ts

@@ -178,7 +178,9 @@ describe("my-audit-log — kumiko-framework#1525: no ambient Temporal global", (
           payload: { limit: 50, from: "2020-01-01T00:00:00Z", to: "2030-01-01T00:00:00Z" },
           user: alice,
         } as Parameters<typeof myAuditLogQuery.handler>[0],
-        { db: { raw: stack.db } } as unknown as Parameters<typeof myAuditLogQuery.handler>[1],
+        { db: { unsafeRaw: () => stack.db } } as unknown as Parameters<
+          typeof myAuditLogQuery.handler
+        >[1],
       );
       expect(res.rows.length).toBeGreaterThanOrEqual(1);
     } finally {

package/src/user-data-rights/handlers/cancel-deletion.write.ts

@@ -1,4 +1,3 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
@@ -6,6 +5,9 @@ import { isWithinGracePeriod } from "../../shared";
 import { USER_STATUS, userTable } from "../../user";
 import { updateUserLifecycle } from "../lib/update-user-lifecycle";
 
+const APPEND_LIFECYCLE_EVENT_REASON =
+  "appends the user lifecycle event on the SYSTEM_TENANT_ID user stream";
+
 // POST /api/user/cancel-deletion (S2.U5).
 //
 // Innerhalb der Grace-Period kann User seinen Forget-Antrag zurueck-
@@ -23,14 +25,14 @@ export const cancelDeletionWrite = defineWriteHandler({
   access: { openToAll: true },
   description:
     "Withdraws the calling user's own pending account-deletion request and puts the account back to active, accepted only while the grace period is still running.",
+  escapeHatch: {
+    reason: APPEND_LIFECYCLE_EVENT_REASON,
+  },
   handler: async (event, ctx) => {
-    // ctx.db.raw (kein TenantDb-Wrapper) weil User-Entity tenant-agnostisch
-    // ist — siehe request-deletion.write.ts fuer die Begruendung. Cancel
-    // muss aus jedem Tenant-Mode den User finden + zuruecksetzen koennen.
-    const row = await fetchOne<{
+    const row = await ctx.db.global(userTable).fetchOne<{
       status: string;
       gracePeriodEnd: Temporal.Instant | null;
-    }>(ctx.db.raw, userTable, { id: event.user.id });
+    }>({ id: event.user.id });
 
     if (!row) {
       return writeFailure(
@@ -52,12 +54,11 @@ export const cancelDeletionWrite = defineWriteHandler({
       return writeFailure(new UnprocessableError("grace_period_expired"));
     }
 
-    await updateUserLifecycle(ctx.db.raw, event.user.id, {
+    await updateUserLifecycle(ctx.db.unsafeRaw(APPEND_LIFECYCLE_EVENT_REASON), event.user.id, {
       status: USER_STATUS.Active,
       gracePeriodEnd: null,
-      // #354/1: schließt das replay-after-cancel-Fenster — ein noch
-      // TTL-gültiges email-Token verifiziert gegen die genullte requestId
-      // nicht mehr und kann keine zweite Grace-Period armen.
+      // #354/1: closes the replay-after-cancel window — a still-TTL-valid email
+      // token verified against the nulled requestId can no longer arm a second grace period.
       pendingDeletionRequestId: null,
     });
 

package/src/user-data-rights/handlers/confirm-deletion-by-token.write.ts

@@ -1,4 +1,3 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineWriteHandler, type HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
@@ -25,9 +24,11 @@ async function readPendingDeletionRequestId(
   userId: string,
 ): Promise<string | null> {
   try {
-    const row = await fetchOne<{ pendingDeletionRequestId: string | null }>(ctx.db.raw, userTable, {
-      id: userId,
-    });
+    const row = await ctx.db
+      .global(userTable)
+      .fetchOne<{ pendingDeletionRequestId: string | null }>({
+        id: userId,
+      });
     return row?.["pendingDeletionRequestId"] ?? null;
   } catch {
     return null;
@@ -54,7 +55,8 @@ export function createConfirmDeletionByTokenHandler(opts: ConfirmDeletionByToken
       reason:
         "startDeletionGracePeriod reads the tenant compliance profile via ctx.queryAs(SYSTEM, " +
         "...) to compute the grace period end — the anonymous token holder has no read access " +
-        "to that tenant-config projection.",
+        "to that tenant-config projection. It also appends the user lifecycle event on the " +
+        "SYSTEM_TENANT_ID user stream.",
     },
     agent: { expose: false },
     rateLimit: { per: "ip", limit: 10, windowSeconds: 60 },

package/src/user-data-rights/handlers/deletion-grace-period.ts

@@ -1,4 +1,3 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { addDurationSpec, type DurationSpec } from "@cosmicdrift/kumiko-framework/compliance";
 import { createSystemUser, type HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
@@ -32,11 +31,9 @@ export async function startDeletionGracePeriod(
   userId: string,
   complianceTenantId: string,
 ): Promise<StartGracePeriodResult> {
-  const userRow = await fetchOne<{ status: string; email: string; locale: string | null }>(
-    ctx.db.raw,
-    userTable,
-    { id: userId },
-  );
+  const userRow = await ctx.db
+    .global(userTable)
+    .fetchOne<{ status: string; email: string; locale: string | null }>({ id: userId });
   if (!userRow) {
     return {
       ok: false,
@@ -66,10 +63,14 @@ export async function startDeletionGracePeriod(
   const T = getTemporal();
   const gracePeriodEnd = addDurationSpec(T.Now.instant(), gracePeriod);
 
-  await updateUserLifecycle(ctx.db.raw, userId, {
-    status: USER_STATUS.DeletionRequested,
-    gracePeriodEnd,
-  });
+  await updateUserLifecycle(
+    ctx.db.unsafeRaw("appends the user lifecycle event on the SYSTEM_TENANT_ID user stream"),
+    userId,
+    {
+      status: USER_STATUS.DeletionRequested,
+      gracePeriodEnd,
+    },
+  );
 
   return {
     ok: true,