@cosmicdrift/kumiko-bundled-features 0.333.0 → 0.335.0

package/dist/user-data-rights/handlers/confirm-deletion-by-token.write.js

@@ -1,9 +1,9 @@
-import { createSystemUser, defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
+import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { USER_STATUS, userTable } from "../../user/index.js";
 import { redeemDeletionToken } from "../deletion-token.js";
-import { startDeletionGracePeriod } from "./deletion-grace-period.js";
+import { resolveGracePeriod, startDeletionGracePeriod } from "./deletion-grace-period.js";
 // Generischer 422 für jeden Token-Fehlerpfad (malformed / bad_signature /
 // expired / kein Secret) — kein Signal ob ein Token zu einem User gehört.
 function invalidToken() {
@@ -55,11 +55,8 @@ export function createConfirmDeletionByTokenHandler(opts = {}) {
                 "SYSTEM_TENANT_ID user stream.",
         },
         agent: { expose: false },
-        rateLimit: { per: "ip", limit: 10, windowSeconds: 60 },
+        rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
         handler: async (event, ctx) => {
-            // @cast-boundary engine-payload — queryAs returns unknown, narrowed to
-            // the compliance-profile shape.
-            const profile = (await ctx.queryAs(createSystemUser(event.user.tenantId), "compliance-profiles:query:for-tenant", {}));
             let gracePeriodEndIso;
             // The row's requestId is part of the verify key, so a token from a
             // cancelled or superseded cycle fails. Every error path ends in the same
@@ -71,7 +68,7 @@ export function createConfirmDeletionByTokenHandler(opts = {}) {
                 secret: opts.deletionTokenSecret,
                 loadPendingRequestId: (userId) => readPendingDeletionRequestId(ctx, userId),
                 commitDeletion: async (userId, requestId) => {
-                    const res = await startDeletionGracePeriod(ctx, userId, profile.profile.userRights.gracePeriod, ctx.db.unsafeRaw("appends the user lifecycle event on the SYSTEM_TENANT_ID user stream"), { pendingDeletionRequestId: requestId });
+                    const res = await startDeletionGracePeriod(ctx, userId, () => resolveGracePeriod(ctx, event.user.tenantId), ctx.db.unsafeRaw("appends the user lifecycle event on the SYSTEM_TENANT_ID user stream"), { pendingDeletionRequestId: requestId });
                     if (!res.ok)
                         return false;
                     gracePeriodEndIso = res.gracePeriodEnd.toString();

package/dist/user-data-rights/handlers/deletion-grace-period.d.ts

@@ -1,9 +1,10 @@
 import { type DurationSpec } from "@cosmicdrift/kumiko-framework/compliance";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
-import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
+import { type HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 type Instant = InstanceType<ReturnType<typeof getTemporal>["Instant"]>;
+export declare function resolveGracePeriod(ctx: HandlerContext, tenantId: string): Promise<DurationSpec>;
 export type StartGracePeriodResult = {
     readonly ok: true;
     readonly gracePeriodEnd: Instant;
@@ -13,5 +14,5 @@ export type StartGracePeriodResult = {
     readonly ok: false;
     readonly error: UnprocessableError;
 };
-export declare function startDeletionGracePeriod(ctx: HandlerContext, userId: string, gracePeriod: DurationSpec, lifecycleRunner: DbRunner, additionalExpect?: Readonly<Record<string, string | number | boolean | null>>): Promise<StartGracePeriodResult>;
+export declare function startDeletionGracePeriod(ctx: HandlerContext, userId: string, resolveGracePeriodSpec: () => Promise<DurationSpec>, lifecycleRunner: DbRunner, additionalExpect?: Readonly<Record<string, string | number | boolean | null>>): Promise<StartGracePeriodResult>;
 export {};

package/dist/user-data-rights/handlers/deletion-grace-period.js

@@ -1,9 +1,21 @@
-import { addDurationSpec } from "@cosmicdrift/kumiko-framework/compliance";
+import { addDurationSpec, } from "@cosmicdrift/kumiko-framework/compliance";
+import { createSystemUser, declareEscapeHatch, } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { decryptStoredPii } from "../../shared/index.js";
 import { USER_STATUS, userTable } from "../../user/index.js";
 import { updateUserLifecycle } from "../lib/update-user-lifecycle.js";
+// Single trust-boundary cast for the compliance-profile lookup: the query
+// handler's declared return type is EffectiveComplianceProfile, but queryAs
+// only hands back unknown. Needs the calling handler's escapeHatch (system
+// queryAs).
+export async function resolveGracePeriod(ctx, tenantId) {
+    declareEscapeHatch({
+        reason: "reads the tenant compliance profile via queryAs(SYSTEM, ...) to compute the grace period end; the calling user's own identity has no read access to that tenant-config projection",
+    });
+    const profile = (await ctx.queryAs(createSystemUser(tenantId), "compliance-profiles:query:for-tenant", {})); // @cast-boundary engine-payload
+    return profile.profile.userRights.gracePeriod;
+}
 // Flips an active user to DeletionRequested and sets gracePeriodEnd from the
 // caller-supplied grace period. Shared between the authenticated
 // request-deletion path (event.user) and the anonymous confirm-by-token path
@@ -13,7 +25,7 @@ import { updateUserLifecycle } from "../lib/update-user-lifecycle.js";
 // ctx.db.global(userTable); only the grace period duration is tenant-configured.
 // That read only supplies email/locale for the caller's notification — it is
 // NOT the transition's guard. The guard is `expect: { status: Active }` on
-// the lifecycle write itself (#3024): the executor re-checks it against a
+// the lifecycle write itself: the executor re-checks it against a
 // fresh row right before writing, so a concurrent caller that already moved
 // the user off Active is rejected even though this read saw Active.
 //
@@ -31,11 +43,13 @@ import { updateUserLifecycle } from "../lib/update-user-lifecycle.js";
 // true). No-op for the authenticated request-deletion path, which never set
 // a pendingDeletionRequestId to begin with.
 //
-// `gracePeriod` and `lifecycleRunner` are resolved by the caller: both
-// require an escalation (reading the tenant compliance profile, appending to
-// the SYSTEM_TENANT_ID user stream) that only the declaring handler's
-// escapeHatch covers.
-export async function startDeletionGracePeriod(ctx, userId, gracePeriod, lifecycleRunner, additionalExpect) {
+// `resolveGracePeriodSpec` and `lifecycleRunner` are supplied by the caller:
+// both require an escalation (reading the tenant compliance profile,
+// appending to the SYSTEM_TENANT_ID user stream) that only the declaring
+// handler's escapeHatch covers. The grace period is a lazy provider so the
+// privileged compliance-profile query only runs for a user that is still
+// Active, not for replayed tokens or already-requested deletions.
+export async function startDeletionGracePeriod(ctx, userId, resolveGracePeriodSpec, lifecycleRunner, additionalExpect) {
     const userRow = await ctx.db
         .global(userTable)
         .fetchOne({ id: userId });
@@ -47,8 +61,16 @@ export async function startDeletionGracePeriod(ctx, userId, gracePeriod, lifecyc
             }),
         };
     }
+    if (userRow["status"] !== USER_STATUS.Active) {
+        return {
+            ok: false,
+            error: new UnprocessableError("user_not_in_active_state", {
+                details: { currentStatus: userRow["status"] },
+            }),
+        };
+    }
     const T = getTemporal();
-    const gracePeriodEnd = addDurationSpec(T.Now.instant(), gracePeriod);
+    const gracePeriodEnd = addDurationSpec(T.Now.instant(), await resolveGracePeriodSpec());
     const { applied } = await updateUserLifecycle(lifecycleRunner, userId, { status: USER_STATUS.DeletionRequested, gracePeriodEnd, pendingDeletionRequestId: null }, { expect: { status: USER_STATUS.Active, ...additionalExpect } });
     if (!applied) {
         return {

package/dist/user-data-rights/handlers/download-by-token.query.js

@@ -56,7 +56,7 @@ export const downloadByTokenQuery = defineQueryHandler({
     // 30 attempts/min/IP reicht fuer legitime User (mehrere Klicks bei
     // Connection-Abbruch); blockiert automatisierte Probing-Loops.
     // Memory `feedback_security_default_on`.
-    rateLimit: { per: "ip", limit: 30, windowSeconds: 60 },
+    rateLimit: { per: "ip+handler", limit: 30, windowSeconds: 60 },
     escapeHatch: {
         reason: DOWNLOAD_BY_TOKEN_REASON,
     },

package/dist/user-data-rights/handlers/request-deletion-by-email.write.js

@@ -34,7 +34,7 @@ export function createRequestDeletionByEmailHandler(opts = {}) {
         // Mails a deletion link to any address the caller names.
         agent: { risk: "high" },
         // Defense-in-depth gegen Email-Probing auf dem anonymen Endpoint.
-        rateLimit: { per: "ip", limit: 10, windowSeconds: 60 },
+        rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
         escapeHatch: {
             reason: APPEND_LIFECYCLE_EVENT_REASON,
         },

package/dist/user-data-rights/handlers/request-deletion.write.js

@@ -1,10 +1,10 @@
 import { createTransportForTenant } from "@cosmicdrift/kumiko-bundled-features/mail-foundation";
-import { createSystemUser, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { USER_STATUS } from "../../user/index.js";
 import { isMailTransportAvailable, makeDefaultDeletionRequestedEmail, } from "../lib/default-mailers.js";
-import { startDeletionGracePeriod } from "./deletion-grace-period.js";
+import { resolveGracePeriod, startDeletionGracePeriod } from "./deletion-grace-period.js";
 // POST /api/user/request-deletion (S2.U5a) — DSGVO Art. 17 Forget-Antrag.
 // Flippt status=Active → deletionRequested, setzt gracePeriodEnd aus dem
 // Compliance-Profile (geteilte Logik: startDeletionGracePeriod). Account-
@@ -29,10 +29,7 @@ export function createRequestDeletionHandler(opts = {}) {
         description: "Starts the GDPR Art. 17 deletion of the calling user's own account by arming the grace period from the tenant compliance profile and mailing a confirmation, after which only cancel-deletion can stop the erasure.",
         agent: { risk: "high" },
         handler: async (event, ctx) => {
-            // @cast-boundary engine-payload — queryAs returns unknown, narrowed to
-            // the compliance-profile shape.
-            const profile = (await ctx.queryAs(createSystemUser(event.user.tenantId), "compliance-profiles:query:for-tenant", {}));
-            const res = await startDeletionGracePeriod(ctx, event.user.id, profile.profile.userRights.gracePeriod, ctx.db.unsafeRaw("appends the user lifecycle event on the SYSTEM_TENANT_ID user stream"));
+            const res = await startDeletionGracePeriod(ctx, event.user.id, () => resolveGracePeriod(ctx, event.user.tenantId), ctx.db.unsafeRaw("appends the user lifecycle event on the SYSTEM_TENANT_ID user stream"));
             if (!res.ok)
                 return writeFailure(res.error);
             const { gracePeriodEnd, userEmail, userLocale } = res;

package/dist/user-data-rights/lib/update-user-lifecycle.js

@@ -26,25 +26,18 @@ const userExecutor = createEventStoreExecutor(userTable, userEntity, { entityNam
 // longer held (precondition_failed) or a concurrent writer won the race on
 // the same stream version (version_conflict) — both mean "someone else's
 // transition already landed", the expected outcome for a caller that opted
-// into `expect`. Any other failure, or a failure with no `expect` set (every
-// pre-#3024 caller), still throws — those callers never checked a return
-// value, so silently dropping their write would be silent data loss.
+// into `expect`. Any other failure, or a failure with no `expect` set, still
+// throws — those callers never checked a return value, so silently dropping
+// their write would be silent data loss.
 export async function updateUserLifecycle(conn, userId, changes, options) {
     // user ist systemStream (#497): der Executor-Choke-Point addressiert den
     // Stream immer auf SYSTEM_TENANT_ID — ein Rescope auf die row-tenant_id
     // waere wirkungslos. "system"-Mode, damit loadById auch Legacy-Rows findet,
     // deren tenant_id noch vor dem #762-Backfill-Rebuild steht.
-    // skipOptimisticLock stays true (kept correct, not just carried over): it
-    // was set from this function's very first version (#494) because every
-    // caller here is a server-side business transition (restrict/lift-
-    // restriction/grace-period/cancel/forget), never a client edit-conflict UI
-    // round-trip — none of them read-then-hold a row version to pass as
-    // `payload.version`, so the executor's version gate would reject every
-    // call outright without it (`update()` requires `payload.version` unless
-    // skipOptimisticLock is set). #3024 replaces the safety that decision gave
-    // up with the purpose-built `expect:` precondition above, checked fresh at
-    // write time — the mechanism now genuinely matches the caller's shape
-    // (a business-field guard) instead of a repurposed version check.
+    // skipOptimisticLock: every caller is a server-side business transition
+    // (restrict/lift-restriction/grace-period/cancel/forget) that holds no row
+    // version to pass as `payload.version`, which update() requires otherwise.
+    // Callers needing a guard use `options.expect` instead.
     const tenantDb = createTenantDb(conn, SYSTEM_TENANT_ID, "system");
     const result = await userExecutor.update({ id: userId, changes }, createSystemUser(SYSTEM_TENANT_ID), tenantDb, { skipOptimisticLock: true, ...(options?.expect && { expect: options.expect }) });
     if (result.isSuccess)

package/dist/user-data-rights/run-export-jobs.d.ts

@@ -5,6 +5,7 @@ import type { MetricsHandle } from "@cosmicdrift/kumiko-framework/observability"
 import type { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 type Instant = InstanceType<ReturnType<typeof getTemporal>["Instant"]>;
 export declare const EXPORT_CLEANUP_BACKLOG_AGE_METRIC = "export_cleanup_backlog_age";
+export declare const EXPORT_CLEANUP_LAST_RUN_TIMESTAMP_METRIC = "export_cleanup_last_run_timestamp";
 export declare const tokenCrud: import("@cosmicdrift/kumiko-types/event-store-executor-types").EventStoreExecutor;
 /**
  * Notification-Callback fuer den done-Pfad. Pattern matched

package/dist/user-data-rights/run-export-jobs.js

@@ -62,6 +62,10 @@ import { generateDownloadToken } from "./token-helpers.js";
 // No "_seconds"/"_total" suffix: validateMetricName rejects both on a gauge.
 // Unit lives in the r.metric() `unit: "seconds"` declaration instead.
 export const EXPORT_CLEANUP_BACKLOG_AGE_METRIC = "export_cleanup_backlog_age";
+// Unix seconds of the last storage-cleanup pass that ran to completion. A
+// gauge keeps its last value in-process (no TTL), so a dead cron does not make
+// the backlog gauge disappear — alert on `time() - this > interval + buffer`.
+export const EXPORT_CLEANUP_LAST_RUN_TIMESTAMP_METRIC = "export_cleanup_last_run_timestamp";
 const crud = createEventStoreExecutor(exportJobsTable, exportJobEntity, {
     entityName: "export-job",
 });
@@ -429,54 +433,71 @@ async function storageCleanupPass(args) {
     // via selectMany (db/queries/export-jobs.ts).
     const candidates = await selectExportJobsForStorageCleanup(db, EXPORT_JOB_STATUS.Done, EXPORT_JOB_STATUS.Failed);
     const cleaned = [];
-    // Done-status candidates past expiresAt+grace, keyed by that due-instant —
-    // used below to report how far cleanup has fallen behind if a candidate
-    // is still standing (delete threw, or the version-checked null-out lost
-    // a race) once the pass is done. Failed-status jobs have no expiresAt
-    // (immediate cleanup, no TTL) so they're out of scope for this signal —
-    // see EXPORT_CLEANUP_BACKLOG_AGE_METRIC's r.metric() description.
+    // Candidates past their due-instant, keyed by that instant — used below to
+    // report how far cleanup has fallen behind if a candidate is still standing
+    // (delete threw, or the version-checked null-out lost a race) once the pass
+    // is done. Done jobs are due at expiresAt+grace; Failed jobs (orphaned ZIPs,
+    // no TTL) are due at completedAt ?? startedAt, i.e. from the first pass.
     const overdueDoneCleanupAfterMs = new Map();
-    for (const c of candidates) {
-        if (!c.downloadStorageKey)
-            continue;
-        // Done-Jobs brauchen expiresAt+grace-Check. Failed-Jobs gehen direkt
-        // durch (kein User-Pfad → sofort cleanup).
-        if (c.status === EXPORT_JOB_STATUS.Done) {
-            if (!c.expiresAt)
+    let passCompleted = false;
+    try {
+        for (const c of candidates) {
+            if (!c.downloadStorageKey)
                 continue;
-            const profile = await resolveProfileForTenant({
-                db,
-                tenantId: c.requestedFromTenantId,
-            });
-            const cleanupAfter = c.expiresAt.epochMilliseconds +
-                profile.profile.userRights.exportStorageCleanupGraceHours * 60 * 60 * 1000;
-            if (now.epochMilliseconds < cleanupAfter)
+            // Done jobs need the expiresAt+grace check. Failed jobs pass straight
+            // through (no user path, so clean up immediately).
+            if (c.status === EXPORT_JOB_STATUS.Done) {
+                if (!c.expiresAt)
+                    continue;
+                // Count the candidate as overdue (lower bound, grace unknown) before the
+                // throwing profile lookup, so a failing pass still shows a backlog.
+                overdueDoneCleanupAfterMs.set(c.id, c.expiresAt.epochMilliseconds);
+                const profile = await resolveProfileForTenant({
+                    db,
+                    tenantId: c.requestedFromTenantId,
+                });
+                const cleanupAfter = c.expiresAt.epochMilliseconds +
+                    profile.profile.userRights.exportStorageCleanupGraceHours * 60 * 60 * 1000;
+                if (now.epochMilliseconds < cleanupAfter) {
+                    overdueDoneCleanupAfterMs.delete(c.id);
+                    continue;
+                }
+                overdueDoneCleanupAfterMs.set(c.id, cleanupAfter);
+            }
+            // Failed-job branch: no TTL check, clean up immediately.
+            else {
+                const failedAt = c.completedAt ?? c.startedAt;
+                if (failedAt)
+                    overdueDoneCleanupAfterMs.set(c.id, failedAt.epochMilliseconds);
+            }
+            // Delete the storage file and null the DB column.
+            try {
+                const provider = await buildStorageProvider(c.requestedFromTenantId);
+                await provider.delete(c.downloadStorageKey);
+            }
+            catch {
+                // best-effort; if the storage delete fails, retry on the next pass
                 continue;
-            overdueDoneCleanupAfterMs.set(c.id, cleanupAfter);
-        }
-        // Failed-Job-Branch: kein TTL-Check, sofort cleanup.
-        // Storage-Datei loeschen + DB-Spalte nullen.
-        try {
-            const provider = await buildStorageProvider(c.requestedFromTenantId);
-            await provider.delete(c.downloadStorageKey);
-        }
-        catch {
-            // best-effort; wenn Storage-Delete failed, retry beim naechsten Pass
-            continue;
+            }
+            const result = await crud.update({
+                id: c.id,
+                version: c.version,
+                changes: { downloadStorageKey: null },
+            }, createSystemUser(c.requestedFromTenantId), systemTenantDb(db, c.requestedFromTenantId));
+            if (result.isSuccess)
+                cleaned.push(c.id);
         }
-        const result = await crud.update({
-            id: c.id,
-            version: c.version,
-            changes: { downloadStorageKey: null },
-        }, createSystemUser(c.requestedFromTenantId), systemTenantDb(db, c.requestedFromTenantId));
-        if (result.isSuccess)
-            cleaned.push(c.id);
+        passCompleted = true;
+    }
+    finally {
+        reportOldestOverdueAge(metrics, overdueDoneCleanupAfterMs, cleaned, now);
+        if (passCompleted)
+            reportCleanupLastRun(metrics, now);
     }
-    reportOldestOverdueAge(metrics, overdueDoneCleanupAfterMs, cleaned, now);
     return cleaned;
 }
-// Seconds since the longest-overdue Done-status bundle should have been
-// deleted (expiresAt+grace passed) but still isn't — 0 when the pass
+// Seconds since the longest-overdue bundle (Done: expiresAt+grace passed;
+// Failed: completedAt ?? startedAt) should have been deleted but still isn't — 0 when the pass
 // cleaned everything that was due, or nothing was due.
 function oldestOverdueAgeSeconds(overdueDoneCleanupAfterMs, cleanedIds, now) {
     const cleaned = new Set(cleanedIds);
@@ -505,6 +526,18 @@ function reportOldestOverdueAge(metrics, overdueDoneCleanupAfterMs, cleanedIds,
         console.warn(`[user-data-rights:run-export-jobs] metrics.set(${EXPORT_CLEANUP_BACKLOG_AGE_METRIC}) failed err=${err instanceof Error ? err.message : String(err)}`);
     }
 }
+function reportCleanupLastRun(metrics, now) {
+    // skip: no meter configured means there is nothing to report.
+    if (!metrics)
+        return;
+    try {
+        metrics.set(EXPORT_CLEANUP_LAST_RUN_TIMESTAMP_METRIC, now.epochMilliseconds / 1000);
+    }
+    catch (err) {
+        // biome-ignore lint/suspicious/noConsole: operator-visibility for observability-emit-failure
+        console.warn(`[user-data-rights:run-export-jobs] metrics.set(${EXPORT_CLEANUP_LAST_RUN_TIMESTAMP_METRIC}) failed err=${err instanceof Error ? err.message : String(err)}`);
+    }
+}
 // Wrapper: crud.update braucht TenantDb. ExportJob ist tenant-agnostisch
 // (1 Job pro userId), aber der event-store-Stream-Lookup erwartet einen
 // Tenant-Context. system-mode TenantDb bypassed den auto-tenant-filter

package/dist/user-data-rights/run-forget-cleanup.js

@@ -35,7 +35,7 @@ import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
 import { createTenantDb, entityEventName, executeRawQuery, nullBlindIndexesForSubject, } from "@cosmicdrift/kumiko-framework/db";
 import { EXT_USER_DATA, EXT_USER_DATA_ORDER, extensionUsageEscapeHatchReason, } from "@cosmicdrift/kumiko-framework/engine";
-import { createEscapeHatchReporter } from "@cosmicdrift/kumiko-framework/pipeline";
+import { createEscapeHatchReporter, UNATTRIBUTED_ACTOR, } from "@cosmicdrift/kumiko-framework/pipeline";
 import { purgeSearchDocumentsForSubject, } from "@cosmicdrift/kumiko-framework/search";
 import { resolveRetentionPolicyForTenant, resolveTenantRetentionPreset, } from "../data-retention/index.js";
 import { decryptStoredPii, runInSubTransaction } from "../shared/index.js";
@@ -47,7 +47,7 @@ function buildHookDb(db, tenantId, entry, args) {
     const report = createEscapeHatchReporter({
         handler: `${EXT_USER_DATA}:${entry.entityName}`,
         tenantId,
-        actor: args.actor ?? "system",
+        actor: args.actor ?? UNATTRIBUTED_ACTOR,
         sink: args.escapeHatchAuditSink,
     });
     return createTenantDb(db, tenantId, "tenant", undefined, undefined, undefined, {

package/dist/user-data-rights/run-user-export.js

@@ -22,15 +22,15 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, } from "@cosmicdrift/kumiko-framework/crypto";
 import { collectEncryptedFieldNames, configuredEntityFieldEncryption, createTenantDb, decryptEntityFieldValues, } from "@cosmicdrift/kumiko-framework/db";
-import { EXT_USER_DATA, extensionUsageEscapeHatchReason, } from "@cosmicdrift/kumiko-framework/engine";
-import { createEscapeHatchReporter } from "@cosmicdrift/kumiko-framework/pipeline";
+import { EXT_USER_DATA, extensionUsageEscapeHatchReason, maskWriteOnlyFields, } from "@cosmicdrift/kumiko-framework/engine";
+import { createEscapeHatchReporter, UNATTRIBUTED_ACTOR, } from "@cosmicdrift/kumiko-framework/pipeline";
 import { tenantMembershipsTable } from "../tenant/index.js";
 import { buildFileRefZipPath } from "./zip-path.js";
 function buildHookDb(db, tenantId, entry, args) {
     const report = createEscapeHatchReporter({
         handler: `${EXT_USER_DATA}:${entry.entityName}`,
         tenantId,
-        actor: args.actor ?? "system",
+        actor: args.actor ?? UNATTRIBUTED_ACTOR,
         sink: args.escapeHatchAuditSink,
     });
     return createTenantDb(db, tenantId, "tenant", undefined, undefined, undefined, {
@@ -214,7 +214,11 @@ async function decryptSnippetFields(registry, hookEntityName, snippet) {
     const entity = registry.getEntity(snippet.entity) ?? registry.getEntity(hookEntityName);
     const encryptedFields = entity ? collectEncryptedFieldNames(entity) : new Set();
     const kms = configuredPiiSubjectKms();
-    const rows = await decryptRecords(snippet.rows, encryptedFields, kms);
+    const decryptedRows = await decryptRecords(snippet.rows, encryptedFields, kms);
+    // Decrypting would otherwise hand writeOnly secrets out as plaintext.
+    const rows = entity
+        ? decryptedRows.map((row) => maskWriteOnlyFields(entity, row))
+        : decryptedRows;
     if (!snippet.fileRefs || snippet.fileRefs.length === 0) {
         return { ...snippet, rows };
     }

package/dist/user-data-rights/schema/download-attempt.d.ts

@@ -9,6 +9,7 @@ export declare const downloadAttemptEntity: import("@cosmicdrift/kumiko-types/fi
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -29,6 +30,7 @@ export declare const downloadAttemptEntity: import("@cosmicdrift/kumiko-types/fi
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -49,6 +51,7 @@ export declare const downloadAttemptEntity: import("@cosmicdrift/kumiko-types/fi
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -69,6 +72,7 @@ export declare const downloadAttemptEntity: import("@cosmicdrift/kumiko-types/fi
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -89,6 +93,7 @@ export declare const downloadAttemptEntity: import("@cosmicdrift/kumiko-types/fi
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -109,6 +114,7 @@ export declare const downloadAttemptEntity: import("@cosmicdrift/kumiko-types/fi
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -129,6 +135,7 @@ export declare const downloadAttemptEntity: import("@cosmicdrift/kumiko-types/fi
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -166,6 +173,7 @@ export declare const downloadAttemptsTable: import("@cosmicdrift/kumiko-framewor
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -186,6 +194,7 @@ export declare const downloadAttemptsTable: import("@cosmicdrift/kumiko-framewor
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -206,6 +215,7 @@ export declare const downloadAttemptsTable: import("@cosmicdrift/kumiko-framewor
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -226,6 +236,7 @@ export declare const downloadAttemptsTable: import("@cosmicdrift/kumiko-framewor
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -246,6 +257,7 @@ export declare const downloadAttemptsTable: import("@cosmicdrift/kumiko-framewor
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -266,6 +278,7 @@ export declare const downloadAttemptsTable: import("@cosmicdrift/kumiko-framewor
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -286,6 +299,7 @@ export declare const downloadAttemptsTable: import("@cosmicdrift/kumiko-framewor
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/user-data-rights/schema/download-token.d.ts

@@ -9,6 +9,7 @@ export declare const exportDownloadTokenEntity: import("@cosmicdrift/kumiko-type
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -29,6 +30,7 @@ export declare const exportDownloadTokenEntity: import("@cosmicdrift/kumiko-type
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -106,6 +108,7 @@ export declare const exportDownloadTokenEntity: import("@cosmicdrift/kumiko-type
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -126,6 +129,7 @@ export declare const exportDownloadTokenEntity: import("@cosmicdrift/kumiko-type
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -148,6 +152,7 @@ export declare const exportDownloadTokensTable: import("@cosmicdrift/kumiko-fram
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -168,6 +173,7 @@ export declare const exportDownloadTokensTable: import("@cosmicdrift/kumiko-fram
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -245,6 +251,7 @@ export declare const exportDownloadTokensTable: import("@cosmicdrift/kumiko-fram
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -265,6 +272,7 @@ export declare const exportDownloadTokensTable: import("@cosmicdrift/kumiko-fram
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;