@cosmicdrift/kumiko-bundled-features 0.328.0 → 0.329.0

package/src/audit/__tests__/audit.integration.test.ts

@@ -1,453 +0,0 @@
-// Audit query — filter-by-example coverage over the event-store. The event
-// log IS the audit trail; this suite proves the query handler exposes the
-// right slices of it (tenant-isolated, filtered, paginated, content-intact).
-
-import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-import {
-  createEntity,
-  createTextField,
-  defineEntityWriteHandler,
-  defineFeature,
-  type SessionUser,
-} from "@cosmicdrift/kumiko-framework/engine";
-import {
-  createTestUser,
-  resetEventStore,
-  setupTestStack,
-  type TestStack,
-  TestUsers,
-  testTenantId,
-  unsafeCreateEntityTable,
-} from "@cosmicdrift/kumiko-framework/stack";
-import { withoutAmbientTemporal } from "@cosmicdrift/kumiko-framework/testing";
-import { buildDateRangePayload, resolveDateRangeFacets } from "@cosmicdrift/kumiko-renderer";
-import { createConfigFeature } from "../../config";
-import { createTenantFeature } from "../../tenant";
-import { createUserFeature } from "../../user";
-import { AUDIT_LOG_SCREEN_ID, AuditQueries } from "../constants";
-import { createAuditFeature } from "../feature";
-
-const widgetEntity = createEntity({
-  table: "audit_widgets",
-  fields: {
-    name: createTextField({ required: true, personal: false, reason: "technical_reference" }),
-    color: createTextField({ personal: false, reason: "technical_reference" }),
-  },
-});
-
-const widgetFeature = defineFeature("widgets", (r) => {
-  r.entity("widget", widgetEntity);
-  for (const verb of ["create", "update", "delete"] as const) {
-    r.writeHandler(
-      defineEntityWriteHandler(`widget:${verb}`, widgetEntity, {
-        access: { roles: ["Admin", "User", "SystemAdmin"] },
-      }),
-    );
-  }
-});
-
-let stack: TestStack;
-
-const admin = TestUsers.systemAdmin;
-const regularUser: SessionUser = createTestUser({
-  id: 7,
-  tenantId: testTenantId(1),
-  roles: ["User"],
-});
-const otherTenantAdmin: SessionUser = createTestUser({
-  id: 8,
-  tenantId: testTenantId(2),
-  roles: ["Admin"],
-});
-
-beforeAll(async () => {
-  stack = await setupTestStack({
-    features: [
-      widgetFeature,
-      createConfigFeature(),
-      createTenantFeature(),
-      createUserFeature(),
-      createAuditFeature(),
-    ],
-  });
-  await unsafeCreateEntityTable(stack.db, widgetEntity);
-});
-
-afterAll(async () => {
-  await stack.cleanup();
-});
-
-beforeEach(async () => {
-  // Fresh event log per test — the audit query reads the events table
-  // directly, so stale events from previous tests would leak into results.
-  await resetEventStore(stack);
-  await asRawClient(stack.db).unsafe(`TRUNCATE audit_widgets`);
-});
-
-async function createWidget(user: SessionUser, name: string, color?: string): Promise<string> {
-  const res = await stack.http.writeOk<{ id: string }>(
-    "widgets:write:widget:create",
-    { name, ...(color && { color }) },
-    user,
-  );
-  return res.id;
-}
-
-type AuditRow = {
-  id: string;
-  aggregateId: string;
-  aggregateType: string;
-  type: string;
-  createdBy: string;
-  createdAt: string;
-  payload: Record<string, unknown>;
-  metadata: Record<string, unknown>;
-};
-
-type AuditResponse = { rows: AuditRow[]; nextBefore: string | null };
-
-describe("audit: list query", () => {
-  test("returns events of the caller's tenant, newest first", async () => {
-    await createWidget(admin, "A");
-    await createWidget(admin, "B");
-    await createWidget(admin, "C");
-
-    const res = await stack.http.queryOk<AuditResponse>(AuditQueries.list, {}, admin);
-    expect(res.rows.length).toBeGreaterThanOrEqual(3);
-    const names = res.rows.map((r) => r.type);
-    expect(names).toContain("widget.created");
-    // Descending by id (bigserial) ⇒ newest first.
-    for (let i = 1; i < res.rows.length; i++) {
-      const prev = BigInt(res.rows[i - 1]!.id);
-      const curr = BigInt(res.rows[i]!.id);
-      expect(prev > curr).toBe(true);
-    }
-  });
-
-  test("tenant isolation: admin on tenant-1 sees NO events from tenant-2", async () => {
-    await createWidget(admin, "on-tenant-1");
-    await stack.http.writeOk<{ id: string }>(
-      "widgets:write:widget:create",
-      { name: "on-tenant-2" },
-      otherTenantAdmin,
-    );
-
-    const res = await stack.http.queryOk<AuditResponse>(AuditQueries.list, {}, admin);
-    for (const r of res.rows) {
-      // Only admin's rows come back — the cross-tenant event's createdBy
-      // would be the other-tenant admin's id.
-      expect(r.createdBy).toBe(admin.id);
-    }
-  });
-
-  test("filter by eventType", async () => {
-    const id1 = await createWidget(admin, "X");
-    await stack.http.writeOk(
-      "widgets:write:widget:update",
-      { id: id1, version: 1, changes: { color: "red" } },
-      admin,
-    );
-    await stack.http.writeOk("widgets:write:widget:delete", { id: id1 }, admin);
-
-    const updates = await stack.http.queryOk<AuditResponse>(
-      AuditQueries.list,
-      { eventType: "widget.updated" },
-      admin,
-    );
-    expect(updates.rows).toHaveLength(1);
-    expect(updates.rows[0]?.type).toBe("widget.updated");
-
-    const deletes = await stack.http.queryOk<AuditResponse>(
-      AuditQueries.list,
-      { eventType: "widget.deleted" },
-      admin,
-    );
-    expect(deletes.rows).toHaveLength(1);
-    expect(deletes.rows[0]?.type).toBe("widget.deleted");
-  });
-
-  test("filter by aggregateId pins the event chain for one entity", async () => {
-    const a = await createWidget(admin, "A");
-    const b = await createWidget(admin, "B");
-    await stack.http.writeOk(
-      "widgets:write:widget:update",
-      { id: a, version: 1, changes: { color: "blue" } },
-      admin,
-    );
-
-    const res = await stack.http.queryOk<AuditResponse>(
-      AuditQueries.list,
-      { aggregateId: a },
-      admin,
-    );
-    expect(res.rows).toHaveLength(2);
-    expect(res.rows.every((r) => r.aggregateId === a)).toBe(true);
-    expect(res.rows.some((r) => r.aggregateId === b)).toBe(false);
-  });
-
-  test("filter by userId", async () => {
-    await createWidget(admin, "by admin");
-    await createWidget(regularUser, "by user");
-
-    const res = await stack.http.queryOk<AuditResponse>(
-      AuditQueries.list,
-      { userId: regularUser.id },
-      admin,
-    );
-    expect(res.rows).toHaveLength(1);
-    expect(res.rows[0]?.createdBy).toBe(regularUser.id);
-  });
-
-  test("filter by from/to date range (inclusive bounds, outside-range rows excluded)", async () => {
-    // Stamp created_at after writes — wall-clock setTimeout anchors race with
-    // ms-precision DB timestamps under load (#1548). Fixed Instant grid keeps
-    // from/to assertions deterministic.
-    await createWidget(admin, "before-window");
-    await createWidget(admin, "in-window-1");
-    await createWidget(admin, "in-window-2");
-    await createWidget(admin, "after-window");
-
-    const listed = await stack.http.queryOk<AuditResponse>(AuditQueries.list, {}, admin);
-    const byName = new Map(
-      listed.rows
-        .filter((r) => r.type === "widget.created")
-        .map((r) => [(r.payload as { name?: string }).name ?? "", r.id]),
-    );
-    const stamps: ReadonlyArray<readonly [string, string]> = [
-      ["before-window", "2020-06-01T12:00:00Z"],
-      ["in-window-1", "2020-06-01T12:00:10Z"],
-      ["in-window-2", "2020-06-01T12:00:20Z"],
-      ["after-window", "2020-06-01T12:00:30Z"],
-    ];
-    for (const [name, createdAt] of stamps) {
-      const id = byName.get(name);
-      if (!id) throw new Error(`missing event for ${name}`);
-      await asRawClient(stack.db).unsafe(
-        `UPDATE kumiko_events SET created_at = $1::timestamptz WHERE id = $2::bigint`,
-        [createdAt, id],
-      );
-    }
-
-    const tFrom = "2020-06-01T12:00:10Z";
-    const tTo = "2020-06-01T12:00:20Z";
-
-    const inWindow = await stack.http.queryOk<AuditResponse>(
-      AuditQueries.list,
-      { from: tFrom, to: tTo },
-      admin,
-    );
-    expect(inWindow.rows).toHaveLength(2);
-    const names = inWindow.rows.map((r) => (r.payload as { name?: string }).name).sort();
-    expect(names).toEqual(["in-window-1", "in-window-2"]);
-
-    const sinceFrom = await stack.http.queryOk<AuditResponse>(
-      AuditQueries.list,
-      { from: tFrom },
-      admin,
-    );
-    expect(sinceFrom.rows).toHaveLength(3);
-
-    const untilBefore = await stack.http.queryOk<AuditResponse>(
-      AuditQueries.list,
-      { to: "2020-06-01T12:00:00Z" },
-      admin,
-    );
-    expect(untilBefore.rows).toHaveLength(1);
-    const untilRow = untilBefore.rows[0];
-    if (!untilRow) throw new Error("expected untilBefore row");
-    expect((untilRow.payload as { name?: string }).name).toBe("before-window");
-  });
-
-  // fw#3104: the audit screen's dateRange facet is the only UI that produces
-  // these bounds. The risk is not the handler (covered above) but the
-  // conversion of a calendar date into an instant: pick "the 14th" as the
-  // upper bound and an event at 23:59 local that day has to stay in the
-  // result. Bounds are derived from the live screen declaration, so a change
-  // to either end of the chain fails here.
-  test("dateRange facet bounds include an event at 23:59 of the `to` day", async () => {
-    const screen = createAuditFeature().screens[AUDIT_LOG_SCREEN_ID];
-    if (screen?.type !== "projectionList") throw new Error("expected a projectionList screen");
-    const specs = resolveDateRangeFacets(screen.facets, (key) => key);
-    expect(specs).toHaveLength(1);
-
-    await createWidget(admin, "late-on-the-14th");
-    await createWidget(admin, "just-after-midnight");
-
-    const listed = await stack.http.queryOk<AuditResponse>(AuditQueries.list, {}, admin);
-    const byName = new Map(
-      listed.rows
-        .filter((r) => r.type === "widget.created")
-        .map((r) => [(r.payload as { name?: string }).name ?? "", r.id]),
-    );
-    // 23:59 and 00:00 Europe/Vienna, expressed as the UTC instants the
-    // event store stores.
-    const stamps: ReadonlyArray<readonly [string, string]> = [
-      ["late-on-the-14th", "2020-06-14T21:59:00Z"],
-      ["just-after-midnight", "2020-06-14T22:00:00Z"],
-    ];
-    for (const [name, createdAt] of stamps) {
-      const id = byName.get(name);
-      if (!id) throw new Error(`missing event for ${name}`);
-      await asRawClient(stack.db).unsafe(
-        `UPDATE kumiko_events SET created_at = $1::timestamptz WHERE id = $2::bigint`,
-        [createdAt, id],
-      );
-    }
-
-    const bounds = buildDateRangePayload(
-      specs,
-      { "createdAt.from": ["2020-06-14"], "createdAt.to": ["2020-06-14"] },
-      "Europe/Vienna",
-    );
-    const inRange = await stack.http.queryOk<AuditResponse>(AuditQueries.list, bounds, admin);
-    const names = inRange.rows.map((r) => (r.payload as { name?: string }).name);
-    expect(names).toContain("late-on-the-14th");
-    expect(names).not.toContain("just-after-midnight");
-  });
-
-  // Open interval from the same declaration — only one bound set must still
-  // reach the handler as a single param.
-  test("dateRange facet with only the `from` bound sends an open interval", async () => {
-    const screen = createAuditFeature().screens[AUDIT_LOG_SCREEN_ID];
-    if (screen?.type !== "projectionList") throw new Error("expected a projectionList screen");
-    const specs = resolveDateRangeFacets(screen.facets, (key) => key);
-
-    await createWidget(admin, "old");
-    await createWidget(admin, "recent");
-    const listed = await stack.http.queryOk<AuditResponse>(AuditQueries.list, {}, admin);
-    const byName = new Map(
-      listed.rows
-        .filter((r) => r.type === "widget.created")
-        .map((r) => [(r.payload as { name?: string }).name ?? "", r.id]),
-    );
-    for (const [name, createdAt] of [
-      ["old", "2020-06-01T12:00:00Z"],
-      ["recent", "2020-06-20T12:00:00Z"],
-    ] as const) {
-      const id = byName.get(name);
-      if (!id) throw new Error(`missing event for ${name}`);
-      await asRawClient(stack.db).unsafe(
-        `UPDATE kumiko_events SET created_at = $1::timestamptz WHERE id = $2::bigint`,
-        [createdAt, id],
-      );
-    }
-
-    const bounds = buildDateRangePayload(
-      specs,
-      { "createdAt.from": ["2020-06-10"] },
-      "Europe/Vienna",
-    );
-    expect(Object.keys(bounds)).toEqual(["from"]);
-    const sinceFrom = await stack.http.queryOk<AuditResponse>(AuditQueries.list, bounds, admin);
-    const names = sinceFrom.rows.map((r) => (r.payload as { name?: string }).name);
-    expect(names).toContain("recent");
-    expect(names).not.toContain("old");
-  });
-
-  test("rejects inverted from/to range with validation_error", async () => {
-    // from > to would silently return empty — confusing. Schema-level refine
-    // turns it into a clean 400 at the gate.
-    const res = await stack.http.query(
-      AuditQueries.list,
-      { from: "2030-01-01T00:00:00Z", to: "2020-01-01T00:00:00Z" },
-      admin,
-    );
-    expect(res.status).toBe(400);
-  });
-
-  test("rejects non-numeric cursor with validation_error (no PG crash path)", async () => {
-    // Pre-fix the handler interpolated `before` directly as bigint, so
-    // "abc" would raise an uncaught invalid_text_representation from PG.
-    // The schema regex catches it at the gate.
-    const res = await stack.http.query(AuditQueries.list, { before: "not-a-number" }, admin);
-    expect(res.status).toBe(400);
-  });
-
-  test("pagination: limit + nextBefore cursor walks the log", async () => {
-    for (let i = 0; i < 5; i++) {
-      await createWidget(admin, `W${i}`);
-    }
-
-    const page1 = await stack.http.queryOk<AuditResponse>(AuditQueries.list, { limit: 2 }, admin);
-    expect(page1.rows).toHaveLength(2);
-    expect(page1.nextBefore).not.toBeNull();
-
-    const page2 = await stack.http.queryOk<AuditResponse>(
-      AuditQueries.list,
-      { limit: 2, before: page1.nextBefore },
-      admin,
-    );
-    expect(page2.rows).toHaveLength(2);
-    const page1Ids = page1.rows.map((r) => r.id);
-    const page2Ids = page2.rows.map((r) => r.id);
-    for (const id of page2Ids) expect(page1Ids).not.toContain(id);
-
-    const page3 = await stack.http.queryOk<AuditResponse>(
-      AuditQueries.list,
-      { limit: 2, before: page2.nextBefore },
-      admin,
-    );
-    // 5 events, 2+2+1: final page is partial ⇒ nextBefore null.
-    expect(page3.rows).toHaveLength(1);
-    expect(page3.nextBefore).toBeNull();
-  });
-
-  test("response carries the full event payload + metadata (the audit-relevant detail)", async () => {
-    const id = await createWidget(admin, "Auditable", "green");
-    await stack.http.writeOk(
-      "widgets:write:widget:update",
-      { id, version: 1, changes: { color: "yellow" } },
-      admin,
-    );
-
-    const res = await stack.http.queryOk<AuditResponse>(
-      AuditQueries.list,
-      { aggregateId: id },
-      admin,
-    );
-    // Two events on this stream: created + updated. Newest first.
-    expect(res.rows).toHaveLength(2);
-    const [updated, created] = res.rows;
-
-    // created: payload IS the initial entity snapshot.
-    expect(created?.type).toBe("widget.created");
-    expect(created?.payload).toMatchObject({ name: "Auditable", color: "green" });
-    // metadata carries the actor (userId) for the write.
-    expect(created?.metadata).toMatchObject({ userId: admin.id });
-
-    // updated: payload is { changes, previous } — both halves matter for audit.
-    expect(updated?.type).toBe("widget.updated");
-    expect(updated?.payload).toMatchObject({
-      changes: { color: "yellow" },
-      previous: expect.objectContaining({ color: "green", name: "Auditable" }),
-    });
-    expect(updated?.metadata).toMatchObject({ userId: admin.id });
-  });
-
-  test("kumiko-framework#1525: from/to filter works without relying on globalThis.Temporal", async () => {
-    await createWidget(admin, "in-range");
-    // createTzContext uses a static temporal-polyfill import; ensureTemporalPolyfill
-    // re-assigns Temporal after teardown (value export). Full HTTP dispatch is
-    // ambient-free for ctx.tz; bare-Temporal paths elsewhere still need the
-    // re-install to succeed if they run in this window.
-    const res = await withoutAmbientTemporal(() =>
-      stack.http.queryOk<AuditResponse>(
-        AuditQueries.list,
-        { limit: 50, from: "2020-01-01T00:00:00Z", to: "2030-01-01T00:00:00Z" },
-        admin,
-      ),
-    );
-    expect(res.rows.length).toBeGreaterThanOrEqual(1);
-  });
-
-  test("access denied for non-admin roles", async () => {
-    await createWidget(admin, "A");
-    const res = await stack.http.query(AuditQueries.list, {}, regularUser);
-    expect(res.status).toBe(403);
-    const body = (await res.json()) as {
-      error?: { code?: string; details?: { reason?: string } };
-    };
-    expect(body.error?.code).toBe("access_denied");
-  });
-});

package/src/audit/__tests__/constants.test.ts

@@ -1,13 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { SYSTEM_ACTOR_ID, SYSTEM_ACTOR_IDS } from "../constants";
-
-describe("audit constants", () => {
-  test("SYSTEM_ACTOR_ID matches the event-store system user id", () => {
-    expect(SYSTEM_ACTOR_ID).toBe("system");
-  });
-
-  test("SYSTEM_ACTOR_IDS includes createSystemUser nil UUID", () => {
-    expect(SYSTEM_ACTOR_IDS.has(SYSTEM_ACTOR_ID)).toBe(true);
-    expect(SYSTEM_ACTOR_IDS.has("00000000-0000-0000-0000-000000000000")).toBe(true);
-  });
-});

package/src/audit/__tests__/escape-hatch-audit.integration.test.ts

@@ -1,107 +0,0 @@
-// fw#2861 — createEscapeHatchAuditSink persists an escape-hatch-use event as
-// audit:event:escape-hatch-used, visible through the existing audit:query:list
-// handler. Real HTTP calls + setupTestStack — never createTestDispatcher.
-// Modelled on audit.integration.test.ts for users/tenant setup + resetEventStore.
-
-import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { defineFeature, type SessionUser } from "@cosmicdrift/kumiko-framework/engine";
-import {
-  createTestUser,
-  resetEventStore,
-  setupTestStack,
-  type TestStack,
-  testTenantId,
-} from "@cosmicdrift/kumiko-framework/stack";
-import { waitFor } from "@cosmicdrift/kumiko-framework/testing";
-import * as z from "zod";
-import { createConfigFeature } from "../../config";
-import { createTenantFeature } from "../../tenant";
-import { createUserFeature } from "../../user";
-import { AuditQueries } from "../constants";
-import { createEscapeHatchAuditSink, ESCAPE_HATCH_USED_EVENT } from "../escape-hatch-audit-sink";
-import { createAuditFeature } from "../feature";
-
-const UNSAFE_RAW_REASON = "fw#2861 bundled-features integration test — declared unsafeRaw write";
-
-const probeFeature = defineFeature("escape-hatch-audit-sink-probe", (r) => {
-  r.writeHandler(
-    "unsafe-raw-write",
-    z.object({}),
-    async (_event, ctx) => {
-      ctx.db.unsafeRaw(UNSAFE_RAW_REASON);
-      return { isSuccess: true as const, data: { ok: true } };
-    },
-    { access: { roles: ["User"] }, escapeHatch: { reason: UNSAFE_RAW_REASON } },
-  );
-});
-
-let stack: TestStack;
-
-const tenantId = testTenantId(1);
-const user: SessionUser = createTestUser({ id: 9, tenantId, roles: ["User"] });
-const adminOfSameTenant: SessionUser = createTestUser({ id: 10, tenantId, roles: ["Admin"] });
-
-beforeAll(async () => {
-  stack = await setupTestStack({
-    features: [
-      probeFeature,
-      createConfigFeature(),
-      createTenantFeature(),
-      createUserFeature(),
-      createAuditFeature(),
-    ],
-    extraContext: ({ db }) => ({ _escapeHatchAuditSink: createEscapeHatchAuditSink({ db }) }),
-  });
-});
-
-afterAll(async () => {
-  await stack.cleanup();
-});
-
-beforeEach(async () => {
-  await resetEventStore(stack);
-});
-
-type AuditRow = {
-  id: string;
-  type: string;
-  createdBy: string;
-  payload: Record<string, unknown>;
-};
-
-type AuditResponse = { rows: AuditRow[]; nextBefore: string | null };
-
-async function pollForEscapeHatchRow(): Promise<AuditRow> {
-  let row: AuditRow | undefined;
-  await waitFor(
-    async () => {
-      const res = await stack.http.queryOk<AuditResponse>(
-        AuditQueries.list,
-        { eventType: ESCAPE_HATCH_USED_EVENT },
-        adminOfSameTenant,
-      );
-      row = res.rows[0];
-      return row !== undefined;
-    },
-    { delays: Array(40).fill(50) },
-  );
-  if (row === undefined) throw new Error("escape-hatch-used audit row did not appear within 2s");
-  return row;
-}
-
-describe("createEscapeHatchAuditSink — persists audit:event:escape-hatch-used", () => {
-  test("an unsafeRaw use is queryable via audit:query:list", async () => {
-    await stack.http.writeOk("escape-hatch-audit-sink-probe:write:unsafe-raw-write", {}, user);
-
-    const row = await pollForEscapeHatchRow();
-
-    expect(row.type).toBe(ESCAPE_HATCH_USED_EVENT);
-    expect(row.createdBy).toBe(user.id);
-    expect(row.payload).toEqual({
-      handler: "escape-hatch-audit-sink-probe:write:unsafe-raw-write",
-      kind: "unsafe-raw",
-      reason: UNSAFE_RAW_REASON,
-      actor: user.id,
-    });
-  });
-});

package/src/audit/constants.ts

@@ -1,26 +0,0 @@
-// @runtime client
-// Qualified handler names + screen ids — shared by server feature and web client.
-export const AUDIT_FEATURE = "audit" as const;
-
-/** Literal `createdBy` written by hand-built system actors (secrets/jobs/…). */
-export const SYSTEM_ACTOR_ID = "system" as const;
-
-/** Literal `createdBy` for anonymous / unauthenticated actors. */
-export const ANONYMOUS_USER_ID = "anonymous" as const;
-
-/** All `createdBy` values that mean "system" in the audit UI (nil-UUID from createSystemUser + literal). */
-export const SYSTEM_ACTOR_IDS: ReadonlySet<string> = new Set([
-  SYSTEM_ACTOR_ID,
-  "00000000-0000-0000-0000-000000000000",
-]);
-
-export const AuditQueries = {
-  list: "audit:query:list",
-  details: "audit:query:details",
-} as const;
-
-/** Tenant-admin audit log screen. Nav: `audit:screen:audit-log`. */
-export const AUDIT_LOG_SCREEN_ID = "audit-log" as const;
-
-/** Single-event detail screen, breadcrumb-linked to the audit-log list. */
-export const AUDIT_LOG_DETAIL_SCREEN_ID = "audit-log-detail" as const;

package/src/audit/escape-hatch-audit-sink.ts

@@ -1,52 +0,0 @@
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import type { EscapeHatchAuditSink, EscapeHatchKind } from "@cosmicdrift/kumiko-framework/engine";
-import { append } from "@cosmicdrift/kumiko-framework/event-store";
-import { generateId } from "@cosmicdrift/kumiko-framework/utils";
-import * as z from "zod";
-
-export const ESCAPE_HATCH_USED_EVENT = "audit:event:escape-hatch-used";
-export const ESCAPE_HATCH_USE_AGGREGATE_TYPE = "escapeHatchUse";
-
-// Kept as a tuple so `satisfies` catches a kind added/removed/renamed on
-// EscapeHatchKind without this schema following along.
-const escapeHatchKinds = [
-  "unsafe-raw",
-  "acknowledge-cross-tenant",
-  "global-write",
-  "identity-switch",
-  "unsafe-all-tenants",
-] as const satisfies readonly EscapeHatchKind[];
-
-export const escapeHatchUsedSchema = z.object({
-  handler: z.string(),
-  kind: z.enum(escapeHatchKinds),
-  reason: z.string(),
-  actor: z.string(),
-  targetUserId: z.string().optional(),
-  targetTenantId: z.string().optional(),
-});
-
-export function createEscapeHatchAuditSink(opts: {
-  readonly db: DbConnection;
-}): EscapeHatchAuditSink {
-  return async (event) => {
-    const payload = escapeHatchUsedSchema.parse({
-      handler: event.handler,
-      kind: event.kind,
-      reason: event.reason,
-      actor: event.actor,
-      ...(event.target && { targetUserId: event.target.id, targetTenantId: event.target.tenantId }),
-    });
-    // Appends on the unbound pool, never the handler tx — an audit entry must
-    // survive a rollback of the handler that used the hatch.
-    await append(opts.db, {
-      aggregateId: generateId(),
-      aggregateType: ESCAPE_HATCH_USE_AGGREGATE_TYPE,
-      tenantId: event.tenantId,
-      expectedVersion: 0,
-      type: ESCAPE_HATCH_USED_EVENT,
-      payload,
-      metadata: { userId: event.actor },
-    });
-  };
-}