@cosmicdrift/kumiko-bundled-features 0.307.0 → 0.309.0

package/src/data-retention/handlers/policy-for.query.ts

@@ -1,6 +1,6 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { parseRetentionOverrideOrNull } from "../_internal/parse-override";
 import { type EffectiveRetentionPolicy, resolveRetentionPolicy } from "../resolver";
 import { tenantRetentionOverrideTable } from "../schema/tenant-retention-override";

package/src/data-retention/override-schema.ts

@@ -13,7 +13,7 @@
 // fallback auf Preset/Entity-Default), aber WAS gesetzt ist muss
 // gueltig sein.
 
-import { z } from "zod";
+import * as z from "zod";
 
 const KEEP_FOR_PATTERN = /^\d+[hdwmy]$/;
 

package/src/data-retention/run-retention-cleanup.ts

@@ -6,7 +6,11 @@
 // Strategy auf Rows an deren reference-Timestamp aelter als der keepFor-Cutoff
 // ist:
 //
-//   - hardDelete  → executor.forget pro Row (Event → rebuild-safe hard purge)
+//   - hardDelete  → executor.forget pro Row (Event → rebuild-safe hard purge).
+//                   Entities with file/image/files/images fields: bytes first
+//                   (incl. derivatives), then the fileRef row(s), then the row;
+//                   shared fileRefs (other owner, other row of the same table)
+//                   stay untouched.
 //   - softDelete  → executor.delete pro Row (Event → rebuild-safe soft-delete),
 //                   nur auf noch-nicht-geloeschte (isDeleted:false-Filter)
 //   - anonymize   → executor.update pro Row mit den Werten der per-Feld
@@ -39,14 +43,22 @@ import {
   createEventStoreExecutor,
   createTenantDb,
   type DbRunner,
+  type TenantDb,
   type WhereObject,
 } from "@cosmicdrift/kumiko-framework/db";
+import { deleteStoredFileAndDerivatives } from "@cosmicdrift/kumiko-framework/derivatives";
 import {
   createSystemUser,
   type EntityId,
   type Registry,
+  type SessionUser,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  type FileContext,
+  fileRefEntity,
+  fileRefsTable,
+} from "@cosmicdrift/kumiko-framework/files";
 import { computeCutoff, type Instant } from "./keep-for";
 import type { RetentionPresetKey } from "./presets";
 import { resolveRetentionPolicyForTenant } from "./resolve-for-tenant";
@@ -76,6 +88,10 @@ export interface RunRetentionCleanupArgs {
   /** Now-Injection — Tests pinnen den Wert ohne Date-Mock (Pattern keep-for.ts). */
   readonly now: Instant;
   readonly batchLimit?: number;
+  /** Storage access for hardDelete entities with file/image/files/images fields.
+   *  Missing while fileRefs are due → the row stays (skipped "missing_file_storage"),
+   *  fail-closed instead of orphaning bytes. */
+  readonly files?: FileContext;
 }
 
 export interface RetentionCleanupSkip {
@@ -83,7 +99,9 @@ export interface RetentionCleanupSkip {
   readonly reason:
     | "missing_reference_column"
     | "missing_softdelete_columns"
-    | "missing_anonymize_fields";
+    | "missing_anonymize_fields"
+    | "missing_file_storage"
+    | "file_delete_failed";
 }
 
 export interface RunRetentionCleanupResult {
@@ -113,6 +131,272 @@ async function purgeMatchingRows(
   return count;
 }
 
+// --- hardDelete + file-fields (kumiko-framework#3089) ---
+
+type FileFieldPlan = {
+  /** type file|image — stores the fileRef-id directly in the entity column. */
+  readonly singleFields: readonly string[];
+  /** type files|images — no entity column, resolved via file_refs. */
+  readonly multiFields: readonly string[];
+};
+
+const NO_FILE_FIELDS: FileFieldPlan = { singleFields: [], multiFields: [] };
+
+// file/image = single-column fields (fileRef-id lives directly in the entity
+// row); files/images = plural, no column, resolved via file_refs. Same set
+// as boot-validator/entity-handler.ts FILE_FIELD_TYPES and engine's
+// isFileField — inlined here rather than importing across the package
+// barrel since this module already needs the single/multi split, not just
+// membership.
+function planFileFields(fields: Readonly<Record<string, unknown>>): FileFieldPlan {
+  const singleFields: string[] = [];
+  const multiFields: string[] = [];
+  for (const [name, field] of Object.entries(fields)) {
+    const type = (field as { readonly type?: unknown }).type; // @cast-boundary schema-walk
+    if (type === "file" || type === "image") singleFields.push(name);
+    else if (type === "files" || type === "images") multiFields.push(name);
+  }
+  return singleFields.length > 0 || multiFields.length > 0
+    ? { singleFields, multiFields }
+    : NO_FILE_FIELDS;
+}
+
+// Every fileRef-id a row's file/image/files/images-fields reference: single
+// fields hold the id in their own column, plural fields have no column and
+// resolve via file_refs (tenantId, entityType, entityId, fieldName).
+async function collectFileRefIds(
+  db: DbRunner,
+  tenantId: TenantId,
+  entityName: string,
+  row: Record<string, unknown>,
+  plan: FileFieldPlan,
+): Promise<readonly string[]> {
+  const ids = new Set<string>();
+  for (const field of plan.singleFields) {
+    const value = row[field];
+    if (typeof value === "string" && value.length > 0) ids.add(value);
+  }
+  if (plan.multiFields.length > 0) {
+    const refRows = await selectMany<{ id: string }>(db, fileRefsTable, {
+      tenantId,
+      entityType: entityName,
+      entityId: String(row["id"]),
+      fieldName: { in: plan.multiFields },
+    });
+    for (const r of refRows) ids.add(r.id);
+  }
+  return Array.from(ids);
+}
+
+// A fileRef is bound to a DIFFERENT entity/record than the row currently
+// being purged — its binding (entityType/entityId), not the row's own
+// single-field column, decides ownership. A single-field value can point at
+// a fileRef uploaded/attached elsewhere; that fileRef's bytes belong to
+// whatever it's actually bound to, not to this row.
+function isFileRefBoundElsewhere(
+  fileRef: Record<string, unknown>,
+  entityName: string,
+  rowId: string,
+): boolean {
+  const entityType = fileRef["entityType"];
+  const entityId = fileRef["entityId"];
+  if (typeof entityType === "string" && entityType !== entityName) return true;
+  if (typeof entityId === "string" && entityId !== rowId) return true;
+  return false;
+}
+
+// A single-field fileRef-id can be shared by more than one row of the SAME
+// table (e.g. a stock-photo re-picked across records). Purging its bytes
+// would corrupt the row that isn't being deleted. Bounded by batchLimit rows
+// per run and singleFields.length queries per fileRef — the same per-row
+// event-cost tradeoff as the rest of this cron (see header).
+async function isFileRefSharedByOtherRow(
+  db: DbRunner,
+  table: Parameters<typeof selectMany>[1],
+  tableHasTenantId: boolean,
+  tenantId: TenantId,
+  rowId: string,
+  singleFields: readonly string[],
+  fileRefId: string,
+): Promise<boolean> {
+  for (const field of singleFields) {
+    const where: WhereObject = { [field]: fileRefId, id: { ne: rowId } };
+    if (tableHasTenantId) where["tenantId"] = tenantId;
+    const others = await selectMany(db, table, where, { limit: 1 });
+    if (others.length > 0) return true;
+  }
+  return false;
+}
+
+// hardDelete for ONE row of an entity that has file/image/files/images
+// fields: delete the un-shared fileRefs' bytes (+ derivatives) first, then
+// their fileRef rows, then the entity row itself — bytes before rows so a
+// crash mid-way leaves an orphaned fileRef pointing at already-gone bytes
+// (safe: a later run's provider.delete is idempotent) rather than a gone
+// fileRef whose bytes leak forever.
+async function purgeHardDeleteRowWithFiles(args: {
+  readonly db: DbRunner;
+  readonly table: Parameters<typeof selectMany>[1];
+  readonly tableHasTenantId: boolean;
+  readonly tenantId: TenantId;
+  readonly entityName: string;
+  readonly row: Record<string, unknown>;
+  readonly plan: FileFieldPlan;
+  readonly files: FileContext | undefined;
+  readonly entityExecutor: ReturnType<typeof createEventStoreExecutor>;
+  readonly fileRefExecutor: ReturnType<typeof createEventStoreExecutor>;
+  readonly systemUser: SessionUser;
+  readonly tdb: TenantDb;
+  readonly onSkip: (reason: "missing_file_storage" | "file_delete_failed") => void;
+}): Promise<boolean> {
+  const rowId = String(args.row["id"]);
+  const fileRefIds = await collectFileRefIds(
+    args.db,
+    args.tenantId,
+    args.entityName,
+    args.row,
+    args.plan,
+  );
+  if (fileRefIds.length === 0) {
+    return (
+      await args.entityExecutor.forget(
+        { id: args.row["id"] as EntityId },
+        args.systemUser,
+        args.tdb,
+      )
+    ).isSuccess;
+  }
+
+  const fileRefRows = await selectMany<Record<string, unknown>>(args.db, fileRefsTable, {
+    id: { in: fileRefIds },
+    tenantId: args.tenantId,
+  });
+
+  const toDelete: Record<string, unknown>[] = [];
+  for (const fileRef of fileRefRows) {
+    if (isFileRefBoundElsewhere(fileRef, args.entityName, rowId)) continue;
+    const shared = await isFileRefSharedByOtherRow(
+      args.db,
+      args.table,
+      args.tableHasTenantId,
+      args.tenantId,
+      rowId,
+      args.plan.singleFields,
+      String(fileRef["id"]),
+    );
+    if (shared) continue;
+    toDelete.push(fileRef);
+  }
+
+  if (toDelete.length === 0) {
+    return (
+      await args.entityExecutor.forget(
+        { id: args.row["id"] as EntityId },
+        args.systemUser,
+        args.tdb,
+      )
+    ).isSuccess;
+  }
+
+  if (!args.files) {
+    args.onSkip("missing_file_storage");
+    return false;
+  }
+  const files = args.files;
+  const store = { list: files.list, delete: (key: string) => files.ref(key).delete() };
+
+  let anyFailed = false;
+  for (const fileRef of toDelete) {
+    const key = fileRef["storageKey"];
+    if (typeof key !== "string" || key.length === 0) continue;
+    const failedKeys = await deleteStoredFileAndDerivatives(
+      key,
+      store,
+      "data-retention:hardDelete",
+    );
+    if (failedKeys.length > 0) {
+      anyFailed = true;
+      // biome-ignore lint/suspicious/noConsole: operator-visibility for storage-cleanup failures
+      console.warn(
+        `[data-retention:hardDelete] tenant=${args.tenantId} entity=${args.entityName} row=${rowId} storage delete failed keys=${failedKeys.join(",")}`,
+      );
+    }
+  }
+  if (anyFailed) {
+    args.onSkip("file_delete_failed");
+    return false;
+  }
+
+  for (const fileRef of toDelete) {
+    const res = await args.fileRefExecutor.forget(
+      { id: fileRef["id"] as EntityId },
+      args.systemUser,
+      args.tdb,
+    );
+    if (!res.isSuccess) {
+      args.onSkip("file_delete_failed");
+      return false;
+    }
+  }
+
+  return (
+    await args.entityExecutor.forget({ id: args.row["id"] as EntityId }, args.systemUser, args.tdb)
+  ).isSuccess;
+}
+
+// hardDelete page for an entity WITH file/image/files/images fields — loads
+// full rows (not just id) so file-field values are available, and reports
+// each skip reason at most once per entity per run (repeat skips would just
+// be noise; the per-row failure is already warned above).
+async function purgeHardDeleteRowsWithFiles(args: {
+  readonly db: DbRunner;
+  readonly table: Parameters<typeof selectMany>[1];
+  readonly tableHasTenantId: boolean;
+  readonly where: WhereObject;
+  readonly batchLimit: number;
+  readonly tenantId: TenantId;
+  readonly entityName: string;
+  readonly plan: FileFieldPlan;
+  readonly files: FileContext | undefined;
+  readonly entityExecutor: ReturnType<typeof createEventStoreExecutor>;
+  readonly fileRefExecutor: ReturnType<typeof createEventStoreExecutor>;
+  readonly systemUser: SessionUser;
+  readonly tdb: TenantDb;
+  readonly skipped: RetentionCleanupSkip[];
+}): Promise<number> {
+  const rows = await selectMany<Record<string, unknown>>(args.db, args.table, args.where, {
+    limit: args.batchLimit,
+  });
+  const reasonsSeen = new Set<RetentionCleanupSkip["reason"]>();
+  const onSkip = (reason: "missing_file_storage" | "file_delete_failed") => {
+    // skip: reason already reported for this entity in this run
+    if (reasonsSeen.has(reason)) return;
+    reasonsSeen.add(reason);
+    args.skipped.push({ entityName: args.entityName, reason });
+  };
+
+  let count = 0;
+  for (const row of rows) {
+    const ok = await purgeHardDeleteRowWithFiles({
+      db: args.db,
+      table: args.table,
+      tableHasTenantId: args.tableHasTenantId,
+      tenantId: args.tenantId,
+      entityName: args.entityName,
+      row,
+      plan: args.plan,
+      files: args.files,
+      entityExecutor: args.entityExecutor,
+      fileRefExecutor: args.fileRefExecutor,
+      systemUser: args.systemUser,
+      tdb: args.tdb,
+      onSkip,
+    });
+    if (ok) count++;
+  }
+  return count;
+}
+
 // PiiAnnotations.anonymize — structural view, avoids reaching into the
 // engine's field-type internals from here.
 type AnonymizeCapableField = { readonly anonymize?: () => unknown | Promise<unknown> };
@@ -244,9 +528,32 @@ export async function runRetentionCleanup(
     switch (policy.strategy) {
       case "hardDelete": {
         const executor = createEventStoreExecutor(proj.table, entity, { entityName });
-        hardDeleted += await purgeMatchingRows(db, proj.table, where, batchLimit, (id) =>
-          executor.forget({ id }, systemUser, tdb),
-        );
+        const filePlan = planFileFields(entity.fields);
+        if (filePlan.singleFields.length === 0 && filePlan.multiFields.length === 0) {
+          hardDeleted += await purgeMatchingRows(db, proj.table, where, batchLimit, (id) =>
+            executor.forget({ id }, systemUser, tdb),
+          );
+          break;
+        }
+        const fileRefExecutor = createEventStoreExecutor(fileRefsTable, fileRefEntity, {
+          entityName: "fileRef",
+        });
+        hardDeleted += await purgeHardDeleteRowsWithFiles({
+          db,
+          table: proj.table,
+          tableHasTenantId: table["tenantId"] !== undefined,
+          where,
+          batchLimit,
+          tenantId,
+          entityName,
+          plan: filePlan,
+          files: args.files,
+          entityExecutor: executor,
+          fileRefExecutor,
+          systemUser,
+          tdb,
+          skipped,
+        });
         break;
       }
       case "softDelete": {

package/src/delivery/__tests__/delivery-pii-kms.integration.test.ts

@@ -28,7 +28,7 @@ import {
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { resetPiiSubjectKmsForTests } from "@cosmicdrift/kumiko-framework/testing";
-import { z } from "zod";
+import * as z from "zod";
 import { createChannelEmailFeature } from "../../channel-email/feature";
 import { createInMemoryTransport } from "../../channel-email/types";
 import { createConfigFeature } from "../../config/feature";

package/src/delivery/__tests__/delivery.integration.test.ts

@@ -26,7 +26,7 @@ import {
   testTenantId,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { z } from "zod";
+import * as z from "zod";
 import { createChannelEmailFeature } from "../../channel-email/feature";
 import { createInMemoryTransport, type EmailMessage } from "../../channel-email/types";
 import { InAppHandlers, InAppQueries } from "../../channel-in-app/constants";

package/src/delivery/events.ts

@@ -3,7 +3,7 @@
 // delivery-service.ts (validates payloads before the low-level append()
 // — out-of-dispatcher writes otherwise skip schema enforcement).
 
-import { z } from "zod";
+import * as z from "zod";
 import { DeliveryStatus } from "./constants";
 
 export const deliveryAttemptSchema = z.object({

package/src/delivery/feature.ts

@@ -5,7 +5,7 @@ import {
   type FeatureDefinition,
   i18nKey,
 } from "@cosmicdrift/kumiko-framework/engine";
-import type { z } from "zod";
+import type * as z from "zod";
 import {
   DELIVERY_ATTEMPT_EVENT,
   DELIVERY_CHANNEL_EXTENSION,

package/src/delivery/handlers/log.query.ts

@@ -8,7 +8,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "temporal-polyfill";
-import { z } from "zod";
+import * as z from "zod";
 import { decryptStoredPii } from "../../shared";
 import type { DeliveryStatusValue } from "../constants";
 import { deliveryAttemptsTable } from "../tables";

package/src/delivery/handlers/preferences.query.ts

@@ -1,7 +1,7 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { notificationPreferencesTable } from "../tables";
 
 export const preferencesQuery = defineQueryHandler({

package/src/delivery/handlers/set-preference.write.ts

@@ -1,6 +1,6 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { upsertPreference } from "../upsert-preference";
 
 export const setPreferenceWrite = defineWriteHandler({

package/src/delivery/jobs.ts

@@ -14,7 +14,7 @@ import type {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import type { JobRunner } from "@cosmicdrift/kumiko-framework/jobs";
-import { z } from "zod";
+import * as z from "zod";
 import { appendAttemptEvent } from "./attempt-log";
 import { buildChannelContext } from "./channel-context";
 import { DeliveryJobs, deliveryPriorityRank } from "./constants";

package/src/delivery/unsubscribe.ts

@@ -2,7 +2,7 @@ import { createTenantDb, type DbConnection } from "@cosmicdrift/kumiko-framework
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { Hono } from "hono";
 import * as jose from "jose";
-import { z } from "zod";
+import * as z from "zod";
 import { upsertPreference } from "./upsert-preference";
 
 // Shape des verified-JWT-payloads. tenantId kommt als string aus jose und

package/src/derivatives-sharp/__tests__/derivatives-sharp.integration.test.ts

@@ -18,7 +18,7 @@ import {
   patchFileInstanceofForBunTest,
 } from "@cosmicdrift/kumiko-framework/testing";
 import sharp from "sharp";
-import { z } from "zod";
+import * as z from "zod";
 import { createConfigFeature } from "../../config";
 import { fileDerivativesFeature } from "../../file-derivatives";
 import { fileFoundationFeature } from "../../file-foundation";

package/src/document-ingest-foundation/events.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import * as z from "zod";
 
 // documentIngest — own aggregate-type for the ingest-request stream, one
 // stream per fileRef (aggregateId = fileRefId). Not backed by an r.entity;

package/src/document-ingest-foundation/feature.ts

@@ -18,7 +18,7 @@ import {
   defineFeature,
   EXT_TENANT_DATA,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { documentExtractEntity } from "./entity";
 import {
   DOCUMENT_INGEST_AGGREGATE_TYPE,

package/src/feature-toggles/__tests__/feature-toggles.integration.test.ts

@@ -29,7 +29,7 @@ import {
 import { createLateBoundHolder, seedRow, waitFor } from "@cosmicdrift/kumiko-framework/testing";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "temporal-polyfill";
-import { z } from "zod";
+import * as z from "zod";
 import { createFeatureTogglesFeature } from "../feature";
 import { globalFeatureStateTable } from "../global-feature-state-table";
 import { GlobalFeatureToggleRuntime } from "../toggle-runtime";

package/src/feature-toggles/events.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import * as z from "zod";
 
 // Toggle-change event payload.
 //

package/src/feature-toggles/handlers/list.query.ts

@@ -1,5 +1,5 @@
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { FEATURE_TOGGLE_CROSS_TENANT_REASON } from "../constants";
 import { globalFeatureStateTable } from "../global-feature-state-table";
 

package/src/feature-toggles/handlers/registered.query.ts

@@ -1,5 +1,5 @@
 import { defineQueryHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { FEATURE_TOGGLE_CROSS_TENANT_REASON } from "../constants";
 import { globalFeatureStateTable } from "../global-feature-state-table";
 

package/src/feature-toggles/handlers/set.write.ts

@@ -6,7 +6,7 @@ import {
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "temporal-polyfill";
-import { z } from "zod";
+import * as z from "zod";
 import {
   FEATURE_TOGGLE_AGGREGATE_TYPE,
   FEATURE_TOGGLE_CROSS_TENANT_REASON,

package/src/file-derivatives/handlers/public-variant.query.ts

@@ -28,7 +28,7 @@ import {
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
-import { z } from "zod";
+import * as z from "zod";
 
 type FileRefRow = {
   readonly entityType: string | null;

package/src/file-foundation/__tests__/file-foundation.integration.test.ts

@@ -28,7 +28,7 @@ import {
   createTestEnvelopeCipher,
   type MutableMasterKeyProvider,
 } from "@cosmicdrift/kumiko-framework/testing";
-import { z } from "zod";
+import * as z from "zod";
 import { createConfigFeature } from "../../config";
 import { ConfigHandlers } from "../../config/constants";
 import { createConfigAccessorFactory } from "../../config/feature";

package/src/files-tenant-data/handlers/sweep-orphaned-derivatives.job.ts

@@ -28,7 +28,7 @@ import {
   type FileStorageProvider,
   fileRefsTable,
 } from "@cosmicdrift/kumiko-framework/files";
-import { z } from "zod";
+import * as z from "zod";
 import { runChunkedMigration } from "../../shared";
 import { tenantTable } from "../../tenant";
 

package/src/folders/handlers/delete-folder.write.ts

@@ -1,6 +1,6 @@
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { DEFAULT_FOLDER_ACCESS } from "../constants";
 import { folderAssignmentExecutor, folderExecutor } from "../executor";
 

package/src/folders/schemas.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import * as z from "zod";
 
 // set-folder + clear-folder share the (entity) reference shape; set-folder adds
 // the target folderId. Folder catalog CRUD (create/update/delete) uses the

package/src/form-draft/schemas.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import * as z from "zod";
 import { FORM_DRAFT_KEY_MAX_LENGTH, FORM_DRAFT_VALUES_MAX_BYTES } from "./constants";
 
 const draftKeySchema = z.string().trim().min(1).max(FORM_DRAFT_KEY_MAX_LENGTH);

package/src/inbound-mail-foundation/events.ts

@@ -19,7 +19,7 @@
 //     eraseSubjectKeys macht Event-Log UND Projection unlesbar
 //     (crypto-shredding, Muster billing-foundation #800).
 
-import { z } from "zod";
+import * as z from "zod";
 import { INBOUND_MAIL_FOUNDATION_FEATURE, InboundMailAccountStatuses } from "./constants";
 
 // Aggregate-types für den event-store.

package/src/inbound-mail-foundation/handlers/connect-account.write.ts

@@ -19,7 +19,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/crypto";
 import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { failUnprocessable } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { InboundMailAccountStatuses, InboundMailAuthMethods } from "../constants";
 import { MAIL_ACCOUNT_PII_FIELDS, mailAccountEntity } from "../entities";
 import {

package/src/inbound-mail-foundation/handlers/disconnect-account.write.ts

@@ -9,7 +9,7 @@
 
 import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { failNotFound } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { InboundMailAccountStatuses } from "../constants";
 import {
   MAIL_ACCOUNT_AGGREGATE_TYPE,

package/src/inbound-mail-foundation/handlers/ingest-message.write.ts

@@ -29,7 +29,7 @@ import { acquireNamespacedAdvisoryLock } from "@cosmicdrift/kumiko-framework/db"
 import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "temporal-polyfill";
-import { z } from "zod";
+import * as z from "zod";
 import { inboundMessageAggregateId, mailThreadAggregateId } from "../aggregate-id";
 import {
   INBOUND_MESSAGE_PII_FIELDS,

package/src/inbound-mail-foundation/handlers/list-accounts.query.ts

@@ -12,7 +12,7 @@ import {
   decryptPiiFieldValues,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import type { QueryHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { MAIL_ACCOUNT_PII_FIELDS } from "../entities";
 import { mailAccountsProjectionTable } from "../projection";
 import { isVisibleToCaller } from "./scope-visibility";