@cosmicdrift/kumiko-bundled-features 0.305.0 → 0.306.0

package/src/document-ingest-foundation/tenant-destroy-hook.ts

@@ -10,32 +10,21 @@
 // (kumiko-framework#1495). The `pages` ciphertext dies separately when the
 // pipeline's later `subject-keys` stage erases the tenant subject key.
 
-import {
-  createEventStoreExecutor,
-  createTenantDb,
-  type DbRunner,
-  selectMany,
-} from "@cosmicdrift/kumiko-framework/db";
-import { createSystemUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createSystemUser, type TenantDataDestroyHook } from "@cosmicdrift/kumiko-framework/engine";
 import { documentExtractEntity, documentExtractsTable } from "./entity";
 
 const executor = createEventStoreExecutor(documentExtractsTable, documentExtractEntity, {
   entityName: "document-extract",
 });
 
-type DestroyCtx = {
-  readonly db: DbRunner;
-  readonly tenantId: TenantId;
-};
-
-export async function documentExtractTenantDestroyHook(ctx: DestroyCtx): Promise<void> {
-  const rows = await selectMany<{ id: string }>(ctx.db, documentExtractsTable, {
+export const documentExtractTenantDestroyHook: TenantDataDestroyHook = async (ctx) => {
+  const rows = await ctx.db.selectMany<{ id: string }>(documentExtractsTable, {
     tenantId: ctx.tenantId,
   });
   const user = createSystemUser(ctx.tenantId);
-  const db = createTenantDb(ctx.db, ctx.tenantId, "system");
   for (const row of rows) {
-    const result = await executor.forget({ id: row.id }, user, db);
+    const result = await executor.forget({ id: row.id }, user, ctx.db);
     // Executor writes return {isSuccess:false} instead of throwing — a
     // discarded result would report this destroy stage "succeeded" while the
     // extracted document text survives. Throw so the pipeline's retry/abandon
@@ -46,4 +35,4 @@ export async function documentExtractTenantDestroyHook(ctx: DestroyCtx): Promise
       );
     }
   }
-}
+};

package/src/file-derivatives/handlers/public-variant.query.ts

@@ -58,6 +58,13 @@ function isDerivativePublicPredicatePlugin(o: unknown): o is DerivativePublicPre
   return typeof o === "object" && o !== null && "isPublic" in o && typeof o.isPublic === "function";
 }
 
+// r.useExtension options-shape, co-located since the framework never imports upward.
+declare module "@cosmicdrift/kumiko-framework/engine" {
+  interface KumikoExtensionOptionsMap {
+    [EXT_DERIVATIVE_PUBLIC_PREDICATE]: DerivativePublicPredicatePlugin;
+  }
+}
+
 // Full QN this handler is registered under once mounted into the
 // "file-derivatives" feature (short name below + registry qualification —
 // see qualifyEntityName). Kept as a separate literal, not derived, so

package/src/files/__tests__/files.integration.test.ts

@@ -65,7 +65,7 @@ describe("files :: cross-feature behavior (F1, S1.7)", () => {
         // Stub-Hooks: in Sprint 2 werden diese die echte Forget-/Export-
         // Logik tragen. Hier reicht: useExtension findet die fileRef-
         // Entity in der Registry → kein Boot-Error.
-        export: async () => [],
+        export: async () => null,
         delete: async () => undefined,
       });
     });
@@ -87,7 +87,7 @@ describe("files :: cross-feature behavior (F1, S1.7)", () => {
     const consumer = defineFeature("test-broken-consumer", (r) => {
       r.requires("test-user-data-provider-2");
       // GHOSTLY: useExtension auf "ghostEntity" gibt es nirgends.
-      r.useExtension(EXT_USER_DATA, "ghostEntity", {});
+      r.useExtension(EXT_USER_DATA, "ghostEntity", { export: async () => null });
     });
 
     // Boot soll laufen — es ist NICHT der Job des Boot-Validators zu

package/src/form-draft/db/queries/__tests__/{unsafe-read-retrying.test.ts → unsafe-read-retrying.integration.test.ts}

@@ -1,31 +1,32 @@
-// #2323: draft-count.ts, owned-file-refs.ts and cleanup.ts read form-draft
-// rows via asRawClient(db).unsafe() directly, bypassing the #1163
-// closed-connection retry that only covered bun-db/query.ts's own
-// selectMany/countWhere. Routed the SELECT-only call sites through
-// unsafeReadRetrying instead — this test mirrors
-// bun-db/__tests__/select-many-retry.test.ts's fake-client pattern to prove
-// the retry now actually fires for each call site.
+// draft-count.ts, owned-file-refs.ts and cleanup.ts read form-draft rows
+// through unsafeReadRetrying; this proves the retry fires per call site
+// using a real captured driver error.
 
-import { describe, expect, test } from "bun:test";
+import { beforeAll, describe, expect, test } from "bun:test";
+import { captureClosedConnectionError } from "@cosmicdrift/kumiko-framework/testing";
 import { Temporal } from "temporal-polyfill";
 import { selectStaleDraftsBatch } from "../cleanup";
 import { countDraftsByOwner } from "../draft-count";
 import { filterOwnedFileRefs } from "../owned-file-refs";
 
-function closedConnectionError(): Error {
-  return Object.assign(new Error("The connection was closed."), { name: "AbortError" });
-}
+let closedConnectionError: unknown;
+
+beforeAll(async () => {
+  closedConnectionError = await captureClosedConnectionError();
+});
 
 type FakeClient = {
   unsafe: (sql: string, params?: readonly unknown[]) => Promise<readonly unknown[]>;
   begin: () => never;
+  options: { max: number };
   calls: number;
 };
 
-function fakeClient(failures: Error[], row: Record<string, unknown>): FakeClient {
+function fakeClient(failures: unknown[], row: Record<string, unknown>): FakeClient {
   const remaining = [...failures];
   const client: FakeClient = {
     calls: 0,
+    options: { max: 1 },
     unsafe: async () => {
       client.calls++;
       const err = remaining.shift();
@@ -39,16 +40,16 @@ function fakeClient(failures: Error[], row: Record<string, unknown>): FakeClient
   return client;
 }
 
-describe("form-draft db/queries — closed-connection retry (#2323)", () => {
+describe("form-draft db/queries — closed-connection retry", () => {
   test("countDraftsByOwner retries once and returns the count", async () => {
-    const db = fakeClient([closedConnectionError()], { count: 4 });
+    const db = fakeClient([closedConnectionError], { count: 4 });
     const result = await countDraftsByOwner(db as never, "t1" as never, "owner1");
     expect(result).toBe(4);
     expect(db.calls).toBe(2);
   });
 
   test("filterOwnedFileRefs retries once and returns rows", async () => {
-    const db = fakeClient([closedConnectionError()], { id: "ref1", storage_key: "key1" });
+    const db = fakeClient([closedConnectionError], { id: "ref1", storage_key: "key1" });
     const rows = await filterOwnedFileRefs(
       db as never,
       "t1" as never,
@@ -63,7 +64,7 @@ describe("form-draft db/queries — closed-connection retry (#2323)", () => {
   });
 
   test("selectStaleDraftsBatch retries once and returns rows", async () => {
-    const db = fakeClient([closedConnectionError()], {
+    const db = fakeClient([closedConnectionError], {
       id: "d1",
       tenant_id: "t1",
       owner_id: "owner1",
@@ -77,11 +78,13 @@ describe("form-draft db/queries — closed-connection retry (#2323)", () => {
     expect(db.calls).toBe(2);
   });
 
-  test("gives up after the single retry when the connection stays closed", async () => {
-    const db = fakeClient([closedConnectionError(), closedConnectionError()], { count: 4 });
-    await expect(countDraftsByOwner(db as never, "t1" as never, "owner1")).rejects.toThrow(
-      "connection was closed",
+  test("gives up after exhausting pool-bounded retries (max: 1 → 3 total calls)", async () => {
+    const db = fakeClient([closedConnectionError, closedConnectionError, closedConnectionError], {
+      count: 4,
+    });
+    await expect(countDraftsByOwner(db as never, "t1" as never, "owner1")).rejects.toBe(
+      closedConnectionError,
     );
-    expect(db.calls).toBe(2);
+    expect(db.calls).toBe(3);
   });
 });

package/src/inbound-mail-foundation/__tests__/tenant-destroy.integration.test.ts

@@ -0,0 +1,173 @@
+// Drives the real tenant-lifecycle destruction sweep: a direct hook call with a hand-built
+// TenantDb hides the escapeHatch grant the "app-data" stage actually resolves.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { configurePiiSubjectKms, InMemoryKmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { append, isStreamArchived, loadAggregate } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  testTenantId,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  resetPiiSubjectKmsForTests,
+  resetTestTables,
+  updateRows,
+} from "@cosmicdrift/kumiko-framework/testing";
+import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import {
+  createComplianceProfilesFeature,
+  tenantComplianceProfileEntity,
+  tenantComplianceProfileTable,
+} from "../../compliance-profiles";
+import { createConfigFeature } from "../../config";
+import { inboundProviderInMemoryFeature } from "../../inbound-provider-inmemory";
+import { tenantMembershipEntity } from "../../tenant";
+import { TenantHandlers } from "../../tenant/constants";
+import { createTenantFeature } from "../../tenant/feature";
+import { tenantEntity, tenantTable } from "../../tenant/schema/tenant";
+import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
+import {
+  TENANT_AGGREGATE_TYPE,
+  TENANT_DESTRUCTION_STARTED_EVENT_QN,
+} from "../../tenant-lifecycle/constants";
+import { runTenantDestructionSweep } from "../../tenant-lifecycle/run-tenant-destroy";
+import { InboundMailFoundationHandlers } from "../constants";
+import { seenMessageEntity, syncCursorEntity } from "../entities";
+import { inboundMailFoundationFeature } from "../feature";
+import { mailAccountsProjectionTable } from "../projection";
+
+let stack: TestStack;
+let db: DbConnection;
+
+function adminFor(tenantNumber: number) {
+  return createTestUser({
+    id: tenantNumber,
+    tenantId: testTenantId(tenantNumber),
+    roles: ["TenantAdmin", "SystemAdmin"],
+  });
+}
+
+const tenantA = adminFor(9101);
+const tenantB = adminFor(9102);
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createTenantFeature(),
+      createComplianceProfilesFeature(),
+      createTenantLifecycleFeature(),
+      inboundMailFoundationFeature,
+      inboundProviderInMemoryFeature,
+    ],
+  });
+  db = stack.db;
+  await unsafeCreateEntityTable(db, tenantEntity);
+  await unsafeCreateEntityTable(db, tenantComplianceProfileEntity);
+  await unsafeCreateEntityTable(db, tenantMembershipEntity);
+  await unsafeCreateEntityTable(db, syncCursorEntity);
+  await unsafeCreateEntityTable(db, seenMessageEntity);
+  configurePiiSubjectKms(new InMemoryKmsAdapter());
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+  resetPiiSubjectKmsForTests();
+});
+
+beforeEach(async () => {
+  stack.events.reset();
+  await resetTestTables(db, [tenantTable, tenantComplianceProfileTable]);
+  await stack.db.unsafe?.(`TRUNCATE kumiko_events, read_mail_accounts RESTART IDENTITY CASCADE`);
+});
+
+async function seedTenant(user: typeof tenantA): Promise<void> {
+  await stack.http.writeOk(
+    TenantHandlers.create,
+    { id: user.tenantId, key: `t-${user.tenantId}`, name: "Tenant" },
+    TestUsers.systemAdmin,
+  );
+  await stack.http.writeOk(
+    "compliance-profiles:write:set-profile",
+    { profileKey: "eu-dsgvo" },
+    user,
+  );
+}
+
+async function seedMailAccount(user: typeof tenantA, address: string): Promise<string> {
+  const result = (await stack.http.writeOk(
+    InboundMailFoundationHandlers.connectAccount,
+    {
+      provider: "inmemory",
+      authMethod: "password",
+      displayName: "Team-Inbox",
+      address,
+      scope: "shared",
+    },
+    user,
+  )) as { accountId: string };
+  return result.accountId;
+}
+
+async function seedDestroyingTenant(tenantId: TenantId): Promise<void> {
+  const now = getTemporal().Now.instant();
+  await updateRows(
+    db,
+    tenantTable,
+    { status: "destroying", destroyStartedAt: now },
+    { id: tenantId },
+  );
+  await append(db, {
+    aggregateId: tenantId,
+    aggregateType: TENANT_AGGREGATE_TYPE,
+    tenantId,
+    expectedVersion: (await loadAggregate(db, tenantId, tenantId)).at(-1)?.version ?? 0,
+    type: TENANT_DESTRUCTION_STARTED_EVENT_QN,
+    payload: { startedAt: now.toString() },
+    metadata: { userId: "system", requestId: "test:destruction-started" },
+  });
+}
+
+async function driveDestructionToCompletion(tenantId: TenantId): Promise<string> {
+  const farFuture = getTemporal()
+    .Now.instant()
+    .add({ hours: 24 * 3650 });
+  let status = "";
+  for (let i = 0; i < 20; i++) {
+    await runTenantDestructionSweep({ db: stack.db, registry: stack.registry, now: farFuture });
+    const rows = await selectMany(db, tenantTable, { id: tenantId });
+    status = String(rows[0]?.["status"]);
+    if (status === "destroyed" || status === "destroyFailed") break;
+  }
+  return status;
+}
+
+describe("inbound-mail-foundation :: tenant destroy (#3196)", () => {
+  test("deletes the mail-account row for the destroyed tenant, archives its stream, leaves another tenant's row untouched", async () => {
+    await seedTenant(tenantA);
+    await seedTenant(tenantB);
+
+    const accountIdA = await seedMailAccount(tenantA, "inbox-a@tenant.example");
+    await seedMailAccount(tenantB, "inbox-b@tenant.example");
+
+    await seedDestroyingTenant(tenantA.tenantId);
+
+    const finalStatus = await driveDestructionToCompletion(tenantA.tenantId);
+    expect(finalStatus).toBe("destroyed");
+
+    const rowsA = await selectMany(db, mailAccountsProjectionTable, { tenantId: tenantA.tenantId });
+    expect(rowsA).toHaveLength(0);
+
+    const rowsB = await selectMany(db, mailAccountsProjectionTable, { tenantId: tenantB.tenantId });
+    expect(rowsB).toHaveLength(1);
+
+    expect(await isStreamArchived(db, tenantA.tenantId, accountIdA)).toBe(true);
+  });
+});

package/src/inbound-mail-foundation/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.306.0",
+    "type": "fix",
+    "title": "Tenant destroy no longer fails on mail-account, inbound-message and mail-thread rows",
+    "detail": "The inbound-mail tenant-destroy hooks passed the tenant-scoped TenantDb they receive into raw DbRunner helpers, so the app-data stage failed and the tenant ended in destroyFailed. They now use ctx.db methods and declare an escapeHatch for the event-stream archive."
+  },
   {
     "version": "0.298.0",
     "type": "breaking",

package/src/inbound-mail-foundation/feature.ts

@@ -91,6 +91,7 @@ import {
 } from "./projection";
 import { runInboundMailRetention } from "./retention-sweep";
 import {
+  INBOUND_MAIL_TENANT_DESTROY_ARCHIVE_REASON,
   inboundMessageTenantDestroyHook,
   mailAccountTenantDestroyHook,
   mailThreadTenantDestroyHook,
@@ -195,12 +196,15 @@ export const inboundMailFoundationFeature = defineFeature(INBOUND_MAIL_FOUNDATIO
   // prueft die EXT_TENANT_DATA-Registrierung pro tenant-subject-Entity.
   r.useExtension(EXT_TENANT_DATA, "mail-account", {
     destroy: mailAccountTenantDestroyHook,
+    escapeHatch: { reason: INBOUND_MAIL_TENANT_DESTROY_ARCHIVE_REASON },
   });
   r.useExtension(EXT_TENANT_DATA, "inbound-message", {
     destroy: inboundMessageTenantDestroyHook,
+    escapeHatch: { reason: INBOUND_MAIL_TENANT_DESTROY_ARCHIVE_REASON },
   });
   r.useExtension(EXT_TENANT_DATA, "mail-thread", {
     destroy: mailThreadTenantDestroyHook,
+    escapeHatch: { reason: INBOUND_MAIL_TENANT_DESTROY_ARCHIVE_REASON },
   });
 
   // Data-Retention (#957) — perTenant fan-out (one run per tenant, like

package/src/inbound-mail-foundation/tenant-destroy-hook.ts

@@ -17,13 +17,8 @@
 // löscht den Tenant-Subject-Key, damit werden Event-Log-Payloads UND
 // etwaige Ciphertext-Kopien unlesbar. Diese Hooks entsorgen die Rows.
 
-import {
-  type DbRunner,
-  deleteMany,
-  type EntityTableMeta,
-  selectMany,
-} from "@cosmicdrift/kumiko-framework/db";
-import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { EntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
+import { declareEscapeHatch, type TenantDataHookCtx } from "@cosmicdrift/kumiko-framework/engine";
 import { archiveStream } from "@cosmicdrift/kumiko-framework/event-store";
 import { seenMessageTable, syncCursorTable } from "./entities";
 import {
@@ -40,19 +35,19 @@ import {
 const ARCHIVED_BY = "tenant-lifecycle:destroy";
 const REASON = "tenant_destroy";
 
-type DestroyCtx = {
-  readonly db: DbRunner;
-  readonly tenantId: TenantId;
-};
+// archiveStream sits outside TenantDb's own methods — needs the escape hatch.
+export const INBOUND_MAIL_TENANT_DESTROY_ARCHIVE_REASON =
+  "tenant-destroy archives each inbound-mail entity's event-streams before the projection rows are deleted";
 
 async function archiveAndDeleteRows(
-  ctx: DestroyCtx,
+  ctx: TenantDataHookCtx,
   table: EntityTableMeta,
   aggregateType: string,
 ): Promise<readonly string[]> {
-  const rows = await selectMany<{ id: string }>(ctx.db, table, { tenantId: ctx.tenantId });
+  declareEscapeHatch({ reason: INBOUND_MAIL_TENANT_DESTROY_ARCHIVE_REASON });
+  const rows = await ctx.db.selectMany<{ id: string }>(table, { tenantId: ctx.tenantId });
   for (const row of rows) {
-    await archiveStream(ctx.db, {
+    await archiveStream(ctx.db.unsafeRaw(INBOUND_MAIL_TENANT_DESTROY_ARCHIVE_REASON), {
       tenantId: ctx.tenantId,
       aggregateId: row.id,
       aggregateType,
@@ -60,23 +55,23 @@ async function archiveAndDeleteRows(
       reason: REASON,
     });
   }
-  await deleteMany(ctx.db, table, { tenantId: ctx.tenantId });
+  await ctx.db.deleteMany(table, { tenantId: ctx.tenantId });
   return rows.map((row) => row.id);
 }
 
-export async function mailAccountTenantDestroyHook(ctx: DestroyCtx): Promise<void> {
+export async function mailAccountTenantDestroyHook(ctx: TenantDataHookCtx): Promise<void> {
   const accountIds = await archiveAndDeleteRows(
     ctx,
     mailAccountsProjectionTable as EntityTableMeta,
     MAIL_ACCOUNT_AGGREGATE_TYPE,
   );
   for (const accountId of accountIds) {
-    await deleteMany(ctx.db, syncCursorTable as EntityTableMeta, { accountId });
-    await deleteMany(ctx.db, seenMessageTable as EntityTableMeta, { accountId });
+    await ctx.db.deleteMany(syncCursorTable as EntityTableMeta, { accountId });
+    await ctx.db.deleteMany(seenMessageTable as EntityTableMeta, { accountId });
   }
 }
 
-export async function inboundMessageTenantDestroyHook(ctx: DestroyCtx): Promise<void> {
+export async function inboundMessageTenantDestroyHook(ctx: TenantDataHookCtx): Promise<void> {
   await archiveAndDeleteRows(
     ctx,
     inboundMessagesProjectionTable as EntityTableMeta,
@@ -84,7 +79,7 @@ export async function inboundMessageTenantDestroyHook(ctx: DestroyCtx): Promise<
   );
 }
 
-export async function mailThreadTenantDestroyHook(ctx: DestroyCtx): Promise<void> {
+export async function mailThreadTenantDestroyHook(ctx: TenantDataHookCtx): Promise<void> {
   await archiveAndDeleteRows(
     ctx,
     mailThreadsProjectionTable as EntityTableMeta,

package/src/inbound-mail-foundation/types.ts

@@ -11,7 +11,7 @@
 // (sichtbarer breaking change) statt ctx-cast.
 
 import type { ConfigAccessor, Registry } from "@cosmicdrift/kumiko-framework/engine";
-import type { InboundMailAccountStatus } from "./constants";
+import { INBOUND_MAIL_PROVIDER_EXTENSION, type InboundMailAccountStatus } from "./constants";
 
 /**
  * Slim-Context für Provider-Plugins.
@@ -180,12 +180,19 @@ export function isInboundMailProviderPlugin(o: unknown): o is InboundMailProvide
     typeof o === "object" &&
     o !== null &&
     "verify" in o &&
-    typeof (o as { verify: unknown }).verify === "function" &&
+    typeof o.verify === "function" &&
     "fetch" in o &&
-    typeof (o as { fetch: unknown }).fetch === "function"
+    typeof o.fetch === "function"
   );
 }
 
+// r.useExtension options-shape, co-located since the framework never imports upward.
+declare module "@cosmicdrift/kumiko-framework/engine" {
+  interface KumikoExtensionOptionsMap {
+    [INBOUND_MAIL_PROVIDER_EXTENSION]: InboundMailProviderPlugin;
+  }
+}
+
 // =============================================================================
 // Typisierte Fehlerklassen — Foundation reagiert einheitlich im Poll
 // (Plan §2, Fehler-Tabelle):

package/src/jobs/__tests__/job-system-user.integration.test.ts

@@ -1,8 +1,8 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import {
+  createSystemDbView,
   createTenantDb,
-  createUncheckedSystemDb,
   type DbConnection,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
@@ -87,7 +87,7 @@ const billingFeature = defineFeature("billing", (r) => {
           {
             db: tenantDb,
             dbOutsideTransaction: tenantDb,
-            systemDb: createUncheckedSystemDb(tenantDb),
+            systemDb: createSystemDbView(tenantDb),
             registry: reg,
             configResolver: ctx["configResolver"] as ConfigResolver,
             ...bridgeStub(),
@@ -177,7 +177,7 @@ describe("SYSTEM_USER in jobs", () => {
       {
         db: adminTenantDb,
         dbOutsideTransaction: adminTenantDb,
-        systemDb: createUncheckedSystemDb(adminTenantDb),
+        systemDb: createSystemDbView(adminTenantDb),
         registry,
         configResolver: resolver,
         ...bridgeStub(),

package/src/jobs/__tests__/reindex-entity-job.integration.test.ts

@@ -10,8 +10,8 @@ import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import {
   buildEntityTable,
   createEventStoreExecutor,
+  createSystemDbView,
   createTenantDb,
-  createUncheckedSystemDb,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
   createEntity,
@@ -19,7 +19,6 @@ import {
   defineFeature,
   type JobContext,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { AccessDeniedError } from "@cosmicdrift/kumiko-framework/errors";
 import {
   setupTestStack,
   type TestStack,
@@ -102,7 +101,11 @@ describe("reindexEntityJob", () => {
       registry: stack.registry,
       searchAdapter: stack.search,
       systemUser: admin,
-      systemDb: createUncheckedSystemDb(createTenantDb(stack.db, admin.tenantId, "system")),
+      systemDb: createSystemDbView(
+        createTenantDb(stack.db, admin.tenantId, "system", undefined, undefined, undefined, {
+          unsafeRaw: { reason: "test: job context mirrors systemScope() grant" },
+        }),
+      ),
       log: noopLogger,
       triggeredBy: null,
       ...bridgeStub(),
@@ -143,7 +146,11 @@ describe("reindexEntityJob", () => {
       registry: stack.registry,
       searchAdapter: stack.search,
       systemUser: admin,
-      systemDb: createUncheckedSystemDb(createTenantDb(stack.db, admin.tenantId, "system")),
+      systemDb: createSystemDbView(
+        createTenantDb(stack.db, admin.tenantId, "system", undefined, undefined, undefined, {
+          unsafeRaw: { reason: "test: job context mirrors systemScope() grant" },
+        }),
+      ),
       log: noopLogger,
       triggeredBy: null,
       ...bridgeStub(),
@@ -207,11 +214,13 @@ describe("reindexEntityJob", () => {
       registry: stack.registry,
       searchAdapter: stack.search,
       systemUser: admin,
-      systemDb: createUncheckedSystemDb(createTenantDb(stack.db, otherTenantId, "system")),
+      systemDb: createSystemDbView(createTenantDb(stack.db, otherTenantId, "system")),
       log: noopLogger,
       triggeredBy: null,
       ...bridgeStub(),
     };
-    await expect(reindexEntityJob({ entity: "widget" }, ctx)).rejects.toThrow(AccessDeniedError);
+    await expect(reindexEntityJob({ entity: "widget" }, ctx)).rejects.toThrow(
+      /tenant self-check failed/,
+    );
   });
 });

package/src/mail-foundation/feature.ts

@@ -46,6 +46,10 @@ import {
 
 const FEATURE_NAME = "mail-foundation";
 
+// Extension-point name for transport-provider plugins (mail-transport-smtp,
+// mail-transport-brevo-api, ...).
+export const MAIL_TRANSPORT_EXTENSION = "mailTransport" as const;
+
 // =============================================================================
 // Plugin-Interface — what a Provider-Plugin must implement
 // =============================================================================
@@ -104,6 +108,13 @@ export function isMailTransportPlugin(o: unknown): o is MailTransportPlugin {
   return typeof o === "object" && o !== null && "build" in o && typeof o.build === "function";
 }
 
+// r.useExtension options-shape, co-located since the framework never imports upward.
+declare module "@cosmicdrift/kumiko-framework/engine" {
+  interface KumikoExtensionOptionsMap {
+    [MAIL_TRANSPORT_EXTENSION]: MailTransportPlugin;
+  }
+}
+
 // =============================================================================
 // Feature-definition
 // =============================================================================
@@ -122,7 +133,7 @@ export const mailFoundationFeature = defineFeature(FEATURE_NAME, (r) => {
   // Plugin extension-point. Provider-features register here. The
   // entityName at registration time becomes the value tenants pick in
   // `provider` config-key (e.g. "smtp", "brevo-api").
-  r.extendsRegistrar("mailTransport", {
+  r.extendsRegistrar(MAIL_TRANSPORT_EXTENSION, {
     onRegister: () => {
       // No side-effects at register-time — the registry stores the
       // usage, factory looks it up at request-time. Same shape as
@@ -150,7 +161,7 @@ export const mailFoundationFeature = defineFeature(FEATURE_NAME, (r) => {
   );
   // Readiness gating: transport-plugins' required keys/secrets count only
   // while their plugin is the one this key selects.
-  r.extensionSelector("mailTransport", providerConfigKey);
+  r.extensionSelector(MAIL_TRANSPORT_EXTENSION, providerConfigKey);
 
   return {
     /** Config-key-handle for the provider-selector. */
@@ -194,7 +205,7 @@ export async function createTransportForTenant(
     "provider",
   ) as string; // @cast-boundary engine-payload
   if (provider.length === 0) {
-    const usages = ctx.registry.getExtensionUsages("mailTransport");
+    const usages = ctx.registry.getExtensionUsages(MAIL_TRANSPORT_EXTENSION);
     const known = usages.map((u) => u.entityName).join(", ") || "<none>";
     throw new Error(
       `${FEATURE_NAME}: no provider selected — set the 'provider' config-key to one of: ${known}. ` +
@@ -202,7 +213,7 @@ export async function createTransportForTenant(
     );
   }
 
-  const usages = ctx.registry.getExtensionUsages("mailTransport");
+  const usages = ctx.registry.getExtensionUsages(MAIL_TRANSPORT_EXTENSION);
   const usage = usages.find((u) => u.entityName === provider);
   if (!usage) {
     const known = usages.map((u) => u.entityName).join(", ") || "<none>";

package/src/mail-foundation/index.ts

@@ -10,6 +10,7 @@
 export {
   createTransportForTenant,
   isMailTransportPlugin,
+  MAIL_TRANSPORT_EXTENSION,
   type MailTransportContext,
   type MailTransportPlugin,
   mailFoundationFeature,