@cosmicdrift/kumiko-bundled-features 0.278.0 → 0.281.0

package/src/data-retention/resolve-for-tenant.ts

@@ -7,15 +7,22 @@
 // + `resolveRetentionPolicy`, also kein Drift-Risiko.
 
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRetentionOverrideOrNull } from "./_internal/parse-override";
 import type { RetentionPresetKey } from "./presets";
 import { type EffectiveRetentionPolicy, resolveRetentionPolicy } from "./resolver";
 import { tenantRetentionOverrideTable } from "./schema/tenant-retention-override";
 
+function isTenantDb(db: DbRunner | TenantDb): db is TenantDb {
+  return typeof (db as Partial<TenantDb>).unsafeRaw === "function";
+}
+
 export interface ResolveForTenantArgs {
-  readonly db: DbRunner;
+  // fw#2914 — a EXT_USER_DATA hook's ctx.db is a TenantDb (method-form);
+  // the cleanup cron's own db is still a raw DbRunner. Both are valid here —
+  // this lookup is a plain tenant-scoped read either way.
+  readonly db: DbRunner | TenantDb;
   readonly registry: Registry;
   readonly tenantId: TenantId;
   readonly entityName: string;
@@ -43,10 +50,15 @@ export async function resolveRetentionPolicyForTenant(
   const overrideRow =
     args.preloadedOverride !== undefined
       ? args.preloadedOverride
-      : ((await fetchOne(args.db, tenantRetentionOverrideTable, {
-          tenantId: args.tenantId,
-          entityName: args.entityName,
-        })) as { config: string | null } | null); // @cast-boundary db-runner
+      : isTenantDb(args.db)
+        ? ((await args.db.fetchOne<{ config: string | null }>(tenantRetentionOverrideTable, {
+            tenantId: args.tenantId,
+            entityName: args.entityName,
+          })) ?? null)
+        : ((await fetchOne(args.db, tenantRetentionOverrideTable, {
+            tenantId: args.tenantId,
+            entityName: args.entityName,
+          })) as { config: string | null } | null); // @cast-boundary db-runner
 
   const tenantOverride = parseRetentionOverrideOrNull(
     overrideRow?.config ?? null,

package/src/delivery/db/queries/preferences.ts

@@ -8,6 +8,7 @@ export type NotificationPreferenceRow = {
   readonly enabled: boolean;
 };
 
+// @wrapper-known semantic-alias
 export async function selectNotificationPreferences(
   db: DbConnection,
   tenantId: TenantId,

package/src/files-tenant-data/hooks.ts

@@ -18,8 +18,7 @@
 //     cross into another tenant's keys (the provider's own list() prefix
 //     already scopes it).
 
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
   type StorageProviderDestroyTenantHook,
@@ -34,13 +33,12 @@ import {
 const crud = createEventStoreExecutor(fileRefsTable, fileRefEntity, { entityName: "fileRef" });
 
 export const fileRefTenantDestroyHook: TenantDataDestroyHook = async (ctx) => {
-  const rows = await selectMany<{ id: string }>(ctx.db, fileRefsTable, {
+  const rows = await ctx.db.selectMany<{ id: string }>(fileRefsTable, {
     tenantId: ctx.tenantId,
   });
   const user = createSystemUser(ctx.tenantId);
-  const db = createTenantDb(ctx.db, ctx.tenantId, "system");
   for (const row of rows) {
-    const result = await crud.forget({ id: row.id }, user, db);
+    const result = await crud.forget({ id: row.id }, user, ctx.db);
     // Executor writes return {isSuccess:false} instead of throwing — a
     // discarded result would report this destroy stage "succeeded" while the
     // row (and its PII fileName) survives. Throw so the pipeline's

package/src/folders/__tests__/folders.integration.test.ts

@@ -17,6 +17,7 @@
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { createEntity, createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -402,7 +403,7 @@ describe("folders-user-data — tenantScopedDelete hooks", () => {
   test("multi-user tenant: no-op, rows survive", async () => {
     await seedOneFolderWithAssignment();
     const ctx = {
-      db: stack.db,
+      db: createTenantDb(stack.db, admin.tenantId, "tenant"),
       registry: stack.registry,
       tenantId: admin.tenantId,
       userId: admin.id,
@@ -417,7 +418,7 @@ describe("folders-user-data — tenantScopedDelete hooks", () => {
   test("anonymize strategy: no-op even on a single-user tenant", async () => {
     await seedOneFolderWithAssignment();
     const ctx = {
-      db: stack.db,
+      db: createTenantDb(stack.db, admin.tenantId, "tenant"),
       registry: stack.registry,
       tenantId: admin.tenantId,
       userId: admin.id,
@@ -432,7 +433,7 @@ describe("folders-user-data — tenantScopedDelete hooks", () => {
   test("single-user tenant + delete: rows are purged", async () => {
     await seedOneFolderWithAssignment();
     const ctx = {
-      db: stack.db,
+      db: createTenantDb(stack.db, admin.tenantId, "tenant"),
       registry: stack.registry,
       tenantId: admin.tenantId,
       userId: admin.id,

package/src/folders-user-data/__tests__/hooks.integration.test.ts

@@ -11,6 +11,7 @@
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { createEntity, createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -87,7 +88,7 @@ describe("folderAssignmentExportHook", () => {
     );
 
     const snippet = await folderAssignmentExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, admin.tenantId, "tenant"),
       registry: stack.registry,
       tenantId: admin.tenantId,
       userId: admin.id,

package/src/folders-user-data/hooks.ts

@@ -4,8 +4,7 @@
 // Mirrors credit-user-data — standard tenant-scoped pattern, no name-stripping
 // (a folder name is tenant data, not per-user PII).
 
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createTenantDb, type EventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import type { EventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import {
   createEntityExecutor,
   createSystemUser,
@@ -27,9 +26,7 @@ const { table: folderAssignmentTable, executor: folderAssignmentExecutor } = cre
 // all tenant folders in-app, so bundling them into the user's export is no new
 // exposure — it gives the data subject the organisation of the loans they work with.
 export const folderExportHook: UserDataExportHook = async (ctx) => {
-  const rows = await selectMany<Record<string, unknown>>(ctx.db, folderTable, {
-    tenantId: ctx.tenantId,
-  });
+  const rows = await ctx.db.selectMany(folderTable, { tenantId: ctx.tenantId });
   if (rows.length === 0) return null;
   return { entity: "folder", rows };
 };
@@ -38,7 +35,7 @@ export const folderAssignmentExportHook: UserDataExportHook = async (ctx) => {
   // folderAssignmentEntity is softDelete: true — a cleared assignment
   // (isDeleted: true) is a removed folder membership, not something the GDPR
   // export should still surface as current data.
-  const rows = await selectMany<Record<string, unknown>>(ctx.db, folderAssignmentTable, {
+  const rows = await ctx.db.selectMany(folderAssignmentTable, {
     tenantId: ctx.tenantId,
     isDeleted: false,
   });
@@ -65,11 +62,9 @@ function tenantScopedDelete(
     // eventless, so a projection rebuild resurrects the rows. Bounded — forget
     // only fires for single-user tenants.
     const systemUser = createSystemUser(ctx.tenantId);
-    // The executor needs a TenantDb (loadById → db.fetchOne), not the raw ctx.db.
-    const tdb = createTenantDb(ctx.db, ctx.tenantId, "system");
-    const rows = await selectMany<{ id: string }>(ctx.db, table, { tenantId: ctx.tenantId });
+    const rows = await ctx.db.selectMany<{ id: string }>(table, { tenantId: ctx.tenantId });
     for (const row of rows) {
-      await executor.delete({ id: row.id }, systemUser, tdb);
+      await executor.delete({ id: row.id }, systemUser, ctx.db);
     }
   };
 }

package/src/form-draft-user-data/__tests__/hooks-delete-failure.integration.test.ts

@@ -7,6 +7,7 @@
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -50,7 +51,12 @@ describe("formDraftDeleteHook — delete failure handling (#review-batch-fw-1)",
 
     await expect(
       formDraftDeleteHook(
-        { db: stack.db, registry: stack.registry, tenantId: bob.tenantId, userId: bob.id },
+        {
+          db: createTenantDb(stack.db, bob.tenantId, "tenant"),
+          registry: stack.registry,
+          tenantId: bob.tenantId,
+          userId: bob.id,
+        },
         "delete",
       ),
     ).resolves.toBeUndefined();

package/src/form-draft-user-data/__tests__/hooks.integration.test.ts

@@ -5,6 +5,7 @@
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -52,7 +53,7 @@ describe("formDraftExportHook", () => {
     );
 
     const snippet = await formDraftExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, owner.tenantId, "tenant"),
       registry: stack.registry,
       tenantId: owner.tenantId,
       userId: owner.id,
@@ -88,7 +89,7 @@ describe("formDraftExportHook", () => {
     );
 
     const snippet = await formDraftExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, tenantATestTenantId, "tenant"),
       registry: stack.registry,
       tenantId: tenantATestTenantId,
       userId: sameIdTenantA.id,
@@ -101,7 +102,7 @@ describe("formDraftExportHook", () => {
   test("returns null when the user saved no drafts", async () => {
     const lurker = createTestUser({ id: 3, roles: ["TenantMember"] });
     const snippet = await formDraftExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, lurker.tenantId, "tenant"),
       registry: stack.registry,
       tenantId: lurker.tenantId,
       userId: lurker.id,
@@ -126,7 +127,12 @@ describe("formDraftDeleteHook", () => {
     );
 
     await formDraftDeleteHook(
-      { db: stack.db, registry: stack.registry, tenantId: alice.tenantId, userId: alice.id },
+      {
+        db: createTenantDb(stack.db, alice.tenantId, "tenant"),
+        registry: stack.registry,
+        tenantId: alice.tenantId,
+        userId: alice.id,
+      },
       "delete",
     );
 
@@ -138,7 +144,12 @@ describe("formDraftDeleteHook", () => {
     const lurker = createTestUser({ id: 13, roles: ["TenantMember"] });
     await expect(
       formDraftDeleteHook(
-        { db: stack.db, registry: stack.registry, tenantId: lurker.tenantId, userId: lurker.id },
+        {
+          db: createTenantDb(stack.db, lurker.tenantId, "tenant"),
+          registry: stack.registry,
+          tenantId: lurker.tenantId,
+          userId: lurker.id,
+        },
         "delete",
       ),
     ).resolves.toBeUndefined();

package/src/form-draft-user-data/hooks.ts

@@ -3,8 +3,6 @@
 // consumers without the user-data-rights pipeline don't pull a hard
 // dependency.
 
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
   type UserDataDeleteHook,
@@ -13,7 +11,7 @@ import {
 import { formDraftExecutor, formDraftTable } from "../form-draft";
 
 export const formDraftExportHook: UserDataExportHook = async (ctx) => {
-  const rows = await selectMany<Record<string, unknown>>(ctx.db, formDraftTable, {
+  const rows = await ctx.db.selectMany(formDraftTable, {
     tenantId: ctx.tenantId,
     ownerId: ctx.userId,
   });
@@ -37,15 +35,14 @@ export const formDraftExportHook: UserDataExportHook = async (ctx) => {
 // owners' drafts, tenant model doesn't matter here (unlike folders' single-
 // user gating: a form-draft row always has exactly one owner already).
 export const formDraftDeleteHook: UserDataDeleteHook = async (ctx) => {
-  const rows = await selectMany<{ id: string }>(ctx.db, formDraftTable, {
+  const rows = await ctx.db.selectMany<{ id: string }>(formDraftTable, {
     tenantId: ctx.tenantId,
     ownerId: ctx.userId,
   });
   const systemUser = createSystemUser(ctx.tenantId);
-  const tdb = createTenantDb(ctx.db, ctx.tenantId, "system");
   const failures: string[] = [];
   for (const row of rows) {
-    const result = await formDraftExecutor.delete({ id: row.id }, systemUser, tdb);
+    const result = await formDraftExecutor.delete({ id: row.id }, systemUser, ctx.db);
     if (!result.isSuccess) {
       failures.push(`${row.id}: ${result.error.message}`);
     }

package/src/notes-history-user-data/__tests__/hooks.integration.test.ts

@@ -5,6 +5,7 @@
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { createEntity, createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -78,7 +79,7 @@ describe("noteEntryExportHook", () => {
     );
 
     const snippet = await noteEntryExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, author.tenantId, "tenant"),
       registry: stack.registry,
       tenantId: author.tenantId,
       userId: author.id,
@@ -95,7 +96,7 @@ describe("noteEntryExportHook", () => {
   test("returns null when the user authored no notes", async () => {
     const lurker = createTestUser({ id: 3, roles: ["TenantMember"] });
     const snippet = await noteEntryExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, lurker.tenantId, "tenant"),
       registry: stack.registry,
       tenantId: lurker.tenantId,
       userId: lurker.id,
@@ -107,7 +108,12 @@ describe("noteEntryExportHook", () => {
 describe("noteEntryDeleteHook", () => {
   test("is a no-op — resolves without throwing", async () => {
     const result = await noteEntryDeleteHook(
-      { db: stack.db, registry: stack.registry, tenantId: author.tenantId, userId: author.id },
+      {
+        db: createTenantDb(stack.db, author.tenantId, "tenant"),
+        registry: stack.registry,
+        tenantId: author.tenantId,
+        userId: author.id,
+      },
       "delete",
     );
     expect(result).toBeUndefined();

package/src/notes-history-user-data/hooks.ts

@@ -4,7 +4,6 @@
 // dependency. Mirrors job-run/delivery-attempt (user-data-rights-defaults):
 // export-only, erasure via crypto-shredding.
 
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms } from "@cosmicdrift/kumiko-framework/crypto";
 import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
 import { resolveRetentionPolicyForTenant } from "../data-retention";
@@ -14,7 +13,7 @@ import { policyToStrategy } from "../user-data-rights";
 // note-entry has no per-tenant scope quirk (unlike folders) — it's genuinely
 // per-user content, so the export filters by authorId directly.
 export const noteEntryExportHook: UserDataExportHook = async (ctx) => {
-  const rows = await selectMany<Record<string, unknown>>(ctx.db, noteEntryTable, {
+  const rows = await ctx.db.selectMany(noteEntryTable, {
     authorId: ctx.userId,
   });
   if (rows.length === 0) return null;
@@ -55,7 +54,7 @@ export const noteEntryDeleteHook: UserDataDeleteHook = async (ctx) => {
   // skip: no KMS adapter mounted — record-owned fields stay plaintext framework-wide, forget is a true no-op
   if (!kms) return;
 
-  const mentions = await selectMany<{ noteId: string }>(ctx.db, noteMentionTable, {
+  const mentions = await ctx.db.selectMany<{ noteId: string }>(noteMentionTable, {
     subjectId: ctx.userId,
   });
   // skip: no note-mention rows for this user — nothing structurally reaches this user's data to shred
@@ -63,7 +62,7 @@ export const noteEntryDeleteHook: UserDataDeleteHook = async (ctx) => {
 
   const noteIds = new Set(mentions.map((m) => m.noteId));
   for (const noteId of noteIds) {
-    const note = await fetchOne<{ entityType: string }>(ctx.db, noteEntryTable, { id: noteId });
+    const note = await ctx.db.fetchOne<{ entityType: string }>(noteEntryTable, { id: noteId });
     // Defensive: append-only rows are never hard-deleted, so this shouldn't
     // happen — but a missing host means no retention policy to consult.
     if (!note) continue;

package/src/personal-access-tokens/handlers/create.write.ts

@@ -30,6 +30,7 @@ export type CreatePatOptions = {
   ) => Promise<PatMfaVerifyResult>;
 };
 
+// @wrapper-known error-helper
 function reauthFailed() {
   return writeFailure(
     new UnprocessableError(PatErrors.reauthRequired, {

package/src/template-resolver-user-data/hooks.ts

@@ -3,7 +3,6 @@
 // so apps without the user-data-rights pipeline don't pull a hard dependency.
 // Mirrors notes-history-user-data: export-only, erasure via crypto-shredding.
 
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
 import { userContentEntriesTable } from "../template-resolver";
 
@@ -11,7 +10,7 @@ import { userContentEntriesTable } from "../template-resolver";
 // scoping comes from the tenant-scoped ctx.db; a user who belongs to two
 // tenants gets each tenant's entries from that tenant's forget run.
 export const userContentExportHook: UserDataExportHook = async (ctx) => {
-  const rows = await selectMany<Record<string, unknown>>(ctx.db, userContentEntriesTable, {
+  const rows = await ctx.db.selectMany(userContentEntriesTable, {
     ownerId: ctx.userId,
   });
   if (rows.length === 0) return null;

package/src/tenant-lifecycle/feature.ts

@@ -132,6 +132,8 @@ export function createTenantLifecycleFeature(): FeatureDefinition {
           now: T.Now.instant(),
           log: (message) => ctx.log?.warn(message),
           fileProviderResolver: ctx._fileProviderResolver,
+          escapeHatchAuditSink: ctx._escapeHatchAuditSink,
+          actor: ctx.systemUser.id,
         });
       },
     });

package/src/tenant-lifecycle/run-tenant-destroy.ts

@@ -3,6 +3,7 @@ import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
+  type EscapeHatchAuditSink,
   type Registry,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
@@ -216,6 +217,8 @@ export async function runNextDestructionStage(args: {
   readonly tenantId: TenantId;
   readonly log?: (message: string) => void;
   readonly fileProviderResolver?: FileProviderResolver;
+  readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
+  readonly actor?: string;
 }): Promise<{ readonly done: boolean; readonly error?: string; readonly halted?: boolean }> {
   const events = await loadAggregate(args.db, args.tenantId, args.tenantId);
   const { completed, abandoned, attemptsByStage } = replayStageState(events);
@@ -238,6 +241,8 @@ export async function runNextDestructionStage(args: {
     tenantId: args.tenantId,
     log: args.log,
     fileProviderResolver: args.fileProviderResolver,
+    escapeHatchAuditSink: args.escapeHatchAuditSink,
+    actor: args.actor,
   };
 
   let version = lastEventVersion(events);
@@ -304,6 +309,8 @@ export async function runTenantDestructionSweep(args: {
   readonly now?: Temporal.Instant;
   readonly log?: (message: string) => void;
   readonly fileProviderResolver?: FileProviderResolver;
+  readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
+  readonly actor?: string;
 }): Promise<{ readonly triggered: number; readonly advanced: number }> {
   const T = getTemporal();
   const now = args.now ?? T.Now.instant();
@@ -353,6 +360,8 @@ export async function runTenantDestructionSweep(args: {
         tenantId: row.id as TenantId,
         log: args.log,
         fileProviderResolver: args.fileProviderResolver,
+        escapeHatchAuditSink: args.escapeHatchAuditSink,
+        actor: args.actor,
       });
       if (!result.error && !result.halted) advanced++;
     } catch (err) {

package/src/tenant-lifecycle/stages.ts

@@ -7,15 +7,19 @@ import {
 } from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
+  type EscapeHatchAuditSink,
   EXT_EXTERNAL_RESOURCE,
   EXT_INFRA_RESOURCE,
   EXT_SEARCH_ADAPTER,
   EXT_STORAGE_PROVIDER,
   EXT_TENANT_DATA,
+  extensionUsageEscapeHatchReason,
   type Registry,
+  type TenantDataHookCtx,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import type { FileProviderResolver } from "@cosmicdrift/kumiko-framework/files";
+import { createEscapeHatchReporter } from "@cosmicdrift/kumiko-framework/pipeline";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import {
   tenantEntity,
@@ -35,6 +39,11 @@ export type DestructionStageCtx = {
   // "destroyTenant" hooks) — undefined when no file-provider is wired,
   // which those hooks must treat as "nothing to clean up", not an error.
   readonly fileProviderResolver?: FileProviderResolver;
+  // fw#2914 — sourced from the owning job's ctx (_escapeHatchAuditSink,
+  // systemUser.id); runTenantDataHooks uses them to attribute+audit any
+  // EXT_TENANT_DATA usage's declared escapeHatch.
+  readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
+  readonly actor?: string;
 };
 
 export type DestructionStage = {
@@ -73,10 +82,25 @@ async function runTenantDataHooks(ctx: DestructionStageCtx): Promise<void> {
   const usages = ctx.registry.getExtensionUsages(EXT_TENANT_DATA);
   for (const usage of usages) {
     const destroy = usage.options?.["destroy"] as
-      | ((ctx: DestructionStageCtx) => Promise<void>)
+      | ((hookCtx: TenantDataHookCtx) => Promise<void>)
       | undefined;
     if (!destroy) continue;
-    await destroy(ctx);
+    const reason = extensionUsageEscapeHatchReason(usage);
+    const report = createEscapeHatchReporter({
+      handler: `${EXT_TENANT_DATA}:${usage.entityName}`,
+      tenantId: ctx.tenantId,
+      actor: ctx.actor ?? "system",
+      sink: ctx.escapeHatchAuditSink,
+    });
+    const hookCtx: TenantDataHookCtx = {
+      db: createTenantDb(ctx.db, ctx.tenantId, "tenant", undefined, undefined, undefined, {
+        unsafeRaw: reason !== undefined ? { reason } : undefined,
+        report,
+      }),
+      registry: ctx.registry,
+      tenantId: ctx.tenantId,
+    };
+    await destroy(hookCtx);
   }
 }
 

package/src/user-data-rights/__tests__/cross-data-matrix.integration.test.ts

@@ -19,6 +19,7 @@ import { defineUnmanagedTable } from "@cosmicdrift/kumiko-framework/db";
 import {
   defineFeature,
   EXT_USER_DATA,
+  SYSTEM_TENANT_ID,
   type UserDataDeleteHook,
   type UserDataExportHook,
 } from "@cosmicdrift/kumiko-framework/engine";
@@ -49,7 +50,7 @@ let stack: TestStack;
 
 const TENANT_A = "00000000-0000-4000-8000-00000000000a";
 const TENANT_B = "00000000-0000-4000-8000-00000000000b";
-const TENANT_SYSTEM = "00000000-0000-4000-8000-000000000001";
+const TENANT_SYSTEM = SYSTEM_TENANT_ID;
 
 function uuid(suffix: number): string {
   return `cccccccc-cccc-4ccc-8ccc-${suffix.toString(16).padStart(12, "0")}`;
@@ -77,20 +78,10 @@ const testNotesTable = defineUnmanagedTable({
 // Stellvertretend fuer App-spezifische Entities (Chat-Message, Blog-Post
 // etc.), die ueber EXT_USER_DATA sauber in die Pipeline integrieren.
 const exportNotes: UserDataExportHook = async (ctx) => {
-  const result = await asRawClient(ctx.db).unsafe(
-    `
-    SELECT id, title, body
-    FROM test_notes
-    WHERE tenant_id = $1 AND author_id = $2
-  `,
-    [ctx.tenantId, ctx.userId],
+  const rows = await ctx.db.selectMany<{ id: string; title: string; body: string }>(
+    testNotesTable,
+    { tenantId: ctx.tenantId, authorId: ctx.userId },
   );
-  // biome-ignore lint/suspicious/noExplicitAny: drizzle execute typing
-  const rows = ((result as any).rows ?? result) as Array<{
-    id: string;
-    title: string;
-    body: string;
-  }>;
   if (rows.length === 0) return null;
   return {
     entity: "note",