@cosmicdrift/kumiko-bundled-features 0.337.1 → 0.339.0

package/dist/crypto-shredding/handlers/forget-subject.write.js

@@ -1,8 +1,7 @@
-import { createHash } from "node:crypto";
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
-import { configuredPiiSubjectKms, subjectIdSchema, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
-import { nullBlindIndexesForSubject, recordRowExistsInTenant, recordRowOwningTenantId, subjectRowExistsInTenant, } from "@cosmicdrift/kumiko-framework/db";
+import { computeBlindIndex, configuredBlindIndexKey, configuredPiiSubjectKms, subjectIdSchema, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
+import { nullBlindIndexesForSubject, recordEventsOwnedExclusivelyByTenant, recordRowExistsInTenant, recordRowOwningTenantId, subjectRowExistsInTenant, } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, InternalError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { append } from "@cosmicdrift/kumiko-framework/event-store";
@@ -26,7 +25,7 @@ export const subjectForgottenSchema = z.object({
     forgottenBy: z.string().min(1),
 });
 export const subjectForgetDeniedSchema = z.object({
-    subjectKeyDigest: z.string().min(1),
+    subjectKeyDigest: z.string().min(1).optional(),
     subjectKind: z.enum(["user", "tenant", "record"]),
     reason: z.string().min(10),
     forgottenBy: z.string().min(1),
@@ -78,13 +77,20 @@ async function resolveTenantScopeDenial(db, features, user, raw) {
         if (!features.has("tenant"))
             return undefined;
         const entity = findRegisteredEntity(features, raw.entity);
-        if (!entity) {
-            return writeFailure(new AccessDeniedError({ details: { reason: RECORD_ENTITY_NOT_REGISTERED } }));
+        const rowInTenant = entity !== undefined &&
+            (await recordRowExistsInTenant(db, features, raw.entity, raw.id, user.tenantId));
+        if (rowInTenant)
+            return undefined;
+        // A deleted row or a custom aggregate without an entity has no projection
+        // row to check; its event stream still proves which tenant owns it.
+        if (await recordEventsOwnedExclusivelyByTenant(db, raw.entity, raw.id, user.tenantId)) {
+            return undefined;
         }
-        const ownedInTenant = await recordRowExistsInTenant(db, features, raw.entity, raw.id, user.tenantId);
-        return ownedInTenant
-            ? undefined
-            : writeFailure(new AccessDeniedError({ details: { reason: TARGET_RECORD_NOT_ADMIN_TENANT } }));
+        return writeFailure(new AccessDeniedError({
+            details: {
+                reason: entity ? TARGET_RECORD_NOT_ADMIN_TENANT : RECORD_ENTITY_NOT_REGISTERED,
+            },
+        }));
     }
     // Without the tenant feature there's no membership table to check against —
     // no scoping concept exists to enforce (single/no-tenant apps only;
@@ -160,15 +166,19 @@ async function appendDenialAuditEvent(ctx, event, subjectKey, subjectKind, denia
             message: `[crypto-shredding] event "${SUBJECT_FORGET_DENIED_EVENT_NAME}" is not registered.`,
         }));
     }
+    const blindIndexKey = configuredBlindIndexKey();
     const payload = subjectForgetDeniedSchema.parse({
         // The denial lands in the REQUESTING actor's own tenant-scoped stream —
         // it must never materialise the foreign subject's identifiers there. A
         // plaintext subjectKey/aggregateId would survive as a permanent record
         // for the prober and would still be present when the owning tenant
         // later runs its own (legitimate) forget-subject for that subject. The
-        // digest still lets an operator correlate repeated probes of the same
-        // subject without exposing it (fw#2452).
-        subjectKeyDigest: createHash("sha256").update(subjectKey, "utf8").digest("base64url"),
+        // digest is keyed (a bare hash of a guessable id could be recomputed from
+        // a candidate id) and lets an operator correlate repeated probes of the
+        // same subject; without a blind-index key no digest is stored at all.
+        ...(blindIndexKey !== undefined && {
+            subjectKeyDigest: computeBlindIndex(blindIndexKey, subjectKey),
+        }),
         subjectKind,
         reason: event.payload.reason,
         forgottenBy: event.user.id,
@@ -216,6 +226,7 @@ export const forgetSubjectWrite = defineWriteHandler({
     // not be able to reach it at all.
     agent: { expose: false, risk: "high" },
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: "denial audit append names the prober's own tenant stream on the outside-transaction db; " +
             "the tenant-scope and retention checks run against the subject's tenant, not necessarily the caller's; " +
             "the blind-index sweep and search purge address the subject across tenants; the user " +
@@ -237,17 +248,17 @@ export const forgetSubjectWrite = defineWriteHandler({
                 ? { kind: "tenant", tenantId: raw.tenantId }
                 : { kind: "record", entity: raw.entity, id: raw.id };
         const subjectKey = subjectIdToKey(subject);
-        const tenantScopeDenial = await resolveTenantScopeDenial(ctx.db.unsafeRaw("tenant-scope check runs against the subject's tenant, not necessarily the caller's"), ctx.registry.features, event.user, raw);
+        const tenantScopeDenial = await resolveTenantScopeDenial(ctx.db.unsafeRaw(), ctx.registry.features, event.user, raw);
         if (tenantScopeDenial) {
-            const auditFailure = await appendDenialAuditEvent(ctx, event, subjectKey, raw.kind, denialReasonOf(tenantScopeDenial), ctx.dbOutsideTransaction?.unsafeRaw("denial audit append: names the prober's own tenant stream on the outside-transaction db"));
+            const auditFailure = await appendDenialAuditEvent(ctx, event, subjectKey, raw.kind, denialReasonOf(tenantScopeDenial), ctx.dbOutsideTransaction?.unsafeRaw());
             return auditFailure ?? tenantScopeDenial;
         }
         // Runs after the tenant gate but before any key is touched: a retention
         // check ahead of the tenant gate would leak a foreign entity's retention
         // posture to a cross-tenant prober.
-        const retentionDenial = await resolveRetentionDenial(ctx, raw, () => ctx.db.unsafeRaw("retention check reads the record row's owning tenant, not the caller's"));
+        const retentionDenial = await resolveRetentionDenial(ctx, raw, () => ctx.db.unsafeRaw());
         if (retentionDenial) {
-            const auditFailure = await appendDenialAuditEvent(ctx, event, subjectKey, raw.kind, TARGET_RECORD_RETENTION_BLOCK_DELETE, ctx.dbOutsideTransaction?.unsafeRaw("denial audit append: names the prober's own tenant stream on the outside-transaction db"));
+            const auditFailure = await appendDenialAuditEvent(ctx, event, subjectKey, raw.kind, TARGET_RECORD_RETENTION_BLOCK_DELETE, ctx.dbOutsideTransaction?.unsafeRaw());
             return auditFailure ?? retentionDenial;
         }
         // Erase BEFORE the audit append: if the append throws, the key is gone
@@ -261,7 +272,7 @@ export const forgetSubjectWrite = defineWriteHandler({
         });
         // Blind-index sweep (#818): nulls bidx columns now so the deterministic
         // HMAC doesn't stay equality-matchable; raw because the ciphertext prefix addresses the subject across tenants.
-        const crossTenantSubjectRunner = ctx.db.unsafeRaw("blind-index sweep and search purge address the subject across tenants");
+        const crossTenantSubjectRunner = ctx.db.unsafeRaw();
         await nullBlindIndexesForSubject(crossTenantSubjectRunner, ctx.registry.features, subjectKey);
         // Derived search index still holds plaintext (#1610) — purge next to the
         // blind-index sweep. No adapter → no-op (apps without search).
@@ -289,7 +300,7 @@ export const forgetSubjectWrite = defineWriteHandler({
         // update is best-effort for real users.
         if (raw.kind === "user" && ctx.registry.features.has("user")) {
             try {
-                const userLifecycleRunner = ctx.db.unsafeRaw("user lifecycle update and PAT revoke run on the SYSTEM user stream");
+                const userLifecycleRunner = ctx.db.unsafeRaw();
                 await updateUserLifecycle(userLifecycleRunner, raw.userId, { status: USER_STATUS.Deleted });
                 if (ctx.registry.features.has("personal-access-tokens")) {
                     await revokeAllPatTokensForUser(userLifecycleRunner, raw.userId);

package/dist/custom-fields/feature.js

@@ -136,12 +136,15 @@ export function resolveFieldDefinitionListRoles(opts) {
     if (opts.valueWriteRoles === undefined && opts.fieldDefinitionWriteRoles === undefined) {
         return DEFAULT_FIELD_DEFINITION_LIST_ROLES;
     }
-    // Write-roles override replaces the default role vocab — don't keep unioning
-    // TenantAdmin onto list when the app opted into its own write roles.
-    if (opts.fieldDefinitionWriteRoles !== undefined) {
-        return [...new Set([...(opts.valueWriteRoles ?? []), ...opts.fieldDefinitionWriteRoles])];
-    }
-    return [...new Set([...(opts.valueWriteRoles ?? []), ...DEFAULT_FIELD_DEFINITION_LIST_ROLES])];
+    // The default stays in the union: with valueWriteRoles unset, TenantAdmin still
+    // saves values and must be able to load the FormSection.
+    return [
+        ...new Set([
+            ...(opts.valueWriteRoles ?? []),
+            ...(opts.fieldDefinitionWriteRoles ?? []),
+            ...DEFAULT_FIELD_DEFINITION_LIST_ROLES,
+        ]),
+    ];
 }
 // Backwards-compat-wrapper. Bestehende Caller (z.B. integration-tests,
 // host-apps) nutzen weiterhin `createCustomFieldsFeature()`. Returnt den

package/dist/custom-fields/handlers/clear-custom-field.write.js

@@ -26,11 +26,12 @@ export const clearCustomFieldHandler = {
     access: { roles: DEFAULT_VALUE_WRITE_ROLES },
     description: "Removes the stored value of one custom field from a single host entity row after re-checking that field's per-field write roles; use it to blank a field the user emptied instead of writing a null value.",
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: CLEAR_CUSTOM_FIELD_REASON,
     },
     handler: async (event, ctx) => {
         const payload = event.payload; // @cast-boundary engine-payload
-        const accessCheck = await checkFieldAccessForWrite(ctx.db.unsafeRaw(CLEAR_CUSTOM_FIELD_REASON), event.user.tenantId, payload.entityName, payload.fieldKey, event.user.roles);
+        const accessCheck = await checkFieldAccessForWrite(ctx.db.unsafeRaw(), event.user.tenantId, payload.entityName, payload.fieldKey, event.user.roles);
         if (!accessCheck.ok) {
             if (accessCheck.reason === "field_definition_not_found") {
                 return failNotFound("fieldDefinition", payload.fieldKey);

package/dist/custom-fields/handlers/define-tenant-field.write.js

@@ -15,6 +15,7 @@ export function createDefineTenantFieldHandler(opts = {}) {
         access: { roles: opts.roles ?? DEFAULT_FIELD_DEFINITION_WRITE_ROLES },
         description: "Creates a custom-field definition owned by the caller's own tenant on the named entity, rejecting the write once the tenant's definition quota is reached; use it when one tenant needs an extra field the other tenants must not see.",
         escapeHatch: {
+            grants: ["unsafeRaw"],
             reason: DEFINE_TENANT_FIELD_REASON,
         },
         handler: async (event, ctx) => {
@@ -25,7 +26,7 @@ export function createDefineTenantFieldHandler(opts = {}) {
                 throw new Error("define-tenant-field: tenantId is SYSTEM_TENANT_ID — use define-system-field for system-scope definitions");
             }
             if (limit !== undefined) {
-                const current = await countTenantFieldDefinitions(ctx.db.unsafeRaw(DEFINE_TENANT_FIELD_REASON), tenantId);
+                const current = await countTenantFieldDefinitions(ctx.db.unsafeRaw(), tenantId);
                 if (current >= limit) {
                     return failUnprocessable("cap_exceeded", {
                         capName: "customFields.fieldDefinition.count",

package/dist/custom-fields/handlers/set-custom-field.write.js

@@ -49,11 +49,12 @@ export const setCustomFieldHandler = {
     access: { roles: DEFAULT_VALUE_WRITE_ROLES },
     description: "Stores one custom-field value on a single host entity row after validating it against the field definition's declared type and per-field write roles; use it to save what a user entered into a custom field.",
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: SET_CUSTOM_FIELD_REASON,
     },
     handler: async (event, ctx) => {
         const payload = event.payload; // @cast-boundary engine-payload
-        const loaded = await loadFieldDefinition(ctx.db.unsafeRaw(SET_CUSTOM_FIELD_REASON), event.user.tenantId, payload.entityName, payload.fieldKey);
+        const loaded = await loadFieldDefinition(ctx.db.unsafeRaw(), event.user.tenantId, payload.entityName, payload.fieldKey);
         if (!loaded.found) {
             return failNotFound("fieldDefinition", payload.fieldKey);
         }

package/dist/custom-fields/wire-user-data-rights.js

@@ -46,7 +46,7 @@ export function wireCustomFieldsUserDataRightsFor(r, opts) {
     const tableName = extractTableName(opts.entityTable, "custom-fields/wire-user-data-rights");
     // biome-ignore lint/correctness/useHookAtTopLevel: r.useExtension is a registrar API, not a React hook.
     r.useExtension(EXT_USER_DATA, opts.entityName, {
-        export: async (ctx) => exportCustomFields(ctx.db.unsafeRaw(CUSTOM_FIELDS_EXPORT_REASON), ctx, tableName, opts),
+        export: async (ctx) => exportCustomFields(ctx.db.unsafeRaw(), ctx, tableName, opts),
         escapeHatch: { reason: CUSTOM_FIELDS_EXPORT_REASON },
     });
 }

package/dist/data-retention/feature.js

@@ -64,7 +64,7 @@ export function createDataRetentionFeature() {
                     return;
                 }
                 const T = (await import("@cosmicdrift/kumiko-framework/time")).getTemporal();
-                const cleanupDb = ctx.db.unsafeRaw("retention cleanup runs raw deletes and preset lookups; every statement filters by this run's tenantId"); // @cast-boundary db-operator — jobs never run inside a DbTx
+                const cleanupDb = ctx.db.unsafeRaw(); // @cast-boundary db-operator — jobs never run inside a DbTx
                 const tenantPreset = await resolveTenantRetentionPreset({
                     db: cleanupDb,
                     registry: ctx.registry,

package/dist/delivery/channel-context.d.ts

@@ -1,5 +1,6 @@
 import type { SseBroker } from "@cosmicdrift/kumiko-framework/api";
 import { type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import type { ChannelContext } from "./types.js";
-export declare function buildChannelContext(db: DbConnection, registry: Registry, sseBroker: SseBroker | undefined, tenantId: TenantId): ChannelContext;
+export declare function buildChannelContext(db: DbConnection, registry: Registry, sseBroker: SseBroker | undefined, tenantId: TenantId, secrets?: SecretsContext): ChannelContext;

package/dist/delivery/channel-context.js

@@ -3,6 +3,6 @@ import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 // Shared by the synchronous delivery-service path and the async job handlers
 // (which pass sseBroker=undefined — only the inline inApp channel uses SSE,
 // and it never runs through a job).
-export function buildChannelContext(db, registry, sseBroker, tenantId) {
-    return { db: createTenantDb(db, tenantId), registry, sseBroker, tenantId };
+export function buildChannelContext(db, registry, sseBroker, tenantId, secrets) {
+    return { db: createTenantDb(db, tenantId), registry, sseBroker, tenantId, secrets };
 }

package/dist/delivery/chat-webhook-channel.d.ts

@@ -0,0 +1,19 @@
+import { type ChatSendResult } from "./chat-webhook-sender.js";
+import type { ChannelMessage, ChannelResult, DeliveryChannel } from "./types.js";
+export type ChatWebhookChannelOptions = {
+    readonly allowedHosts?: readonly string[];
+    readonly requireHttps?: boolean;
+    readonly timeoutMs?: number;
+};
+export declare function toChannelResult(address: string, result: ChatSendResult): ChannelResult;
+export declare function chatMessageText(message: ChannelMessage): string;
+export type ChatWebhookChannelSpec = {
+    readonly name: string;
+    readonly featureName: string;
+    readonly defaultAllowedHosts: readonly string[];
+    readonly requiredPathPrefix?: string;
+    readonly keyFor: (connection: string) => string;
+    readonly buildBody: (message: ChannelMessage) => unknown;
+    readonly options: ChatWebhookChannelOptions;
+};
+export declare function createChatWebhookChannel(spec: ChatWebhookChannelSpec): DeliveryChannel;

package/dist/delivery/chat-webhook-channel.js

@@ -0,0 +1,48 @@
+import { SYSTEM_USER_ID } from "@cosmicdrift/kumiko-types/identifiers";
+import { chatConnectionNameSchema, DEFAULT_CHAT_TIMEOUT_MS, postChatWebhook, } from "./chat-webhook-sender.js";
+export function toChannelResult(address, result) {
+    return result.ok
+        ? { status: "sent", address }
+        : { status: "failed", error: result.code, address };
+}
+export function chatMessageText(message) {
+    return message.body ? `${message.title}\n${message.body}` : message.title;
+}
+// Slack/Discord/Teams: the route address is a tenant-chosen connection name, the
+// webhook URL lives in the secrets store under that name. Route-only (no resolve).
+export function createChatWebhookChannel(spec) {
+    const { options } = spec;
+    return {
+        name: spec.name,
+        mode: "queued",
+        async send(address, message, ctx) {
+            if (!chatConnectionNameSchema.safeParse(address).success) {
+                return toChannelResult(address, { ok: false, code: "invalid_address" });
+            }
+            let url;
+            try {
+                const revealed = await ctx.secrets?.get(ctx.tenantId, spec.keyFor(address), {
+                    userId: SYSTEM_USER_ID,
+                    handlerName: `${spec.featureName}:send`,
+                });
+                url = revealed?.reveal();
+            }
+            catch {
+                url = undefined;
+            }
+            if (!url)
+                return toChannelResult(address, { ok: false, code: "missing_credentials" });
+            const result = await postChatWebhook({
+                url,
+                allowedHosts: options.allowedHosts ?? spec.defaultAllowedHosts,
+                requireHttps: options.requireHttps ?? true,
+                ...(spec.requiredPathPrefix !== undefined && {
+                    requiredPathPrefix: spec.requiredPathPrefix,
+                }),
+                timeoutMs: options.timeoutMs ?? DEFAULT_CHAT_TIMEOUT_MS,
+                body: spec.buildBody(message),
+            });
+            return toChannelResult(address, result);
+        },
+    };
+}

package/dist/delivery/chat-webhook-sender.d.ts

@@ -0,0 +1,21 @@
+import * as z from "zod";
+export type ChatSendFailureCode = `http_${number}` | "timeout" | "network_error" | "redirect_blocked" | "host_not_allowed" | "missing_credentials" | "invalid_address";
+export type ChatSendResult = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly code: ChatSendFailureCode;
+};
+export declare const DEFAULT_CHAT_TIMEOUT_MS = 10000;
+export declare const chatConnectionNameSchema: z.ZodString;
+export type ChatWebhookRequest = {
+    readonly url: string;
+    readonly allowedHosts: readonly string[];
+    readonly requireHttps: boolean;
+    readonly requiredPathPrefix?: string;
+    readonly timeoutMs: number;
+    readonly body: unknown;
+    readonly send?: (url: string, init: RequestInit) => Promise<Response>;
+};
+export declare function postChatWebhook(request: ChatWebhookRequest): Promise<ChatSendResult>;
+export declare function truncateChars(text: string, maxChars: number): string;

package/dist/delivery/chat-webhook-sender.js

@@ -0,0 +1,102 @@
+import { BlockedHostError, egress } from "@cosmicdrift/kumiko-framework/http";
+import * as z from "zod";
+export const DEFAULT_CHAT_TIMEOUT_MS = 10_000;
+// Tenant-chosen connection name (the route address for webhook channels). Also
+// the suffix the secrets write gate accepts under the channel's namespace, so
+// the two cannot drift. Validated before it is used to build a secret key.
+export const chatConnectionNameSchema = z
+    .string()
+    .min(1)
+    .max(64)
+    .regex(/^[a-z0-9][a-z0-9-]*$/);
+// https targets are provider endpoints on public hosts: egress "external" adds
+// the private/reserved-range denial and DNS pinning on top of our allowlist. The
+// cleartext opt-out (requireHttps: false) exists for operator-trusted local
+// endpoints, which "external" would refuse; the allowlist already pins the host.
+function policyFor(request, target) {
+    return request.requireHttps
+        ? { kind: "external" }
+        : { kind: "internal", allowHosts: [target.hostname] };
+}
+function hostMatches(hostname, allowedHost) {
+    const allowed = allowedHost.toLowerCase();
+    if (allowed.startsWith(".")) {
+        return hostname.length > allowed.length && hostname.endsWith(allowed);
+    }
+    return hostname === allowed;
+}
+// Allowlist runs on the parsed URL, never on the raw string: userinfo
+// (`https://hooks.slack.com@evil.com`) and look-alike suffixes must not pass.
+function checkTarget(request) {
+    let parsed;
+    try {
+        parsed = new URL(request.url);
+    }
+    catch {
+        return undefined;
+    }
+    const protocolAllowed = parsed.protocol === "https:" || (!request.requireHttps && parsed.protocol === "http:");
+    if (!protocolAllowed)
+        return undefined;
+    // egress() has no port rule; a provider webhook over https never needs a custom port.
+    if (request.requireHttps && parsed.port !== "")
+        return undefined;
+    if (parsed.username !== "" || parsed.password !== "")
+        return undefined;
+    const hostname = parsed.hostname.toLowerCase();
+    if (!request.allowedHosts.some((allowed) => hostMatches(hostname, allowed)))
+        return undefined;
+    if (request.requiredPathPrefix !== undefined &&
+        !parsed.pathname.startsWith(request.requiredPathPrefix)) {
+        return undefined;
+    }
+    return parsed;
+}
+function isTimeout(err) {
+    return err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError");
+}
+// egress(internal) follows same-host redirects itself and throws on cross-host
+// ones; both are the "redirect" outcome here. Matched on the stable message
+// prefix only — the message is discarded, it can carry the Location header.
+function isEgressRedirectRefusal(err) {
+    return err instanceof Error && err.message.startsWith("egress(internal): redirect");
+}
+function classifyFailure(err) {
+    if (err instanceof BlockedHostError)
+        return "host_not_allowed";
+    if (isEgressRedirectRefusal(err))
+        return "redirect_blocked";
+    return isTimeout(err) ? "timeout" : "network_error";
+}
+// Never throws and never surfaces the URL: egress/Bun errors can carry it, so
+// every failure is reduced to a code here.
+export async function postChatWebhook(request) {
+    const target = checkTarget(request);
+    if (!target)
+        return { ok: false, code: "host_not_allowed" };
+    let response;
+    try {
+        const send = request.send ?? egress(policyFor(request, target));
+        response = await send(target.toString(), {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify(request.body),
+            signal: AbortSignal.timeout(request.timeoutMs),
+        });
+    }
+    catch (err) {
+        return { ok: false, code: classifyFailure(err) };
+    }
+    // Free the connection; the body is never read or stored.
+    await response.body?.cancel().catch(() => undefined);
+    const { status } = response;
+    if (status >= 300 && status < 400)
+        return { ok: false, code: "redirect_blocked" };
+    if (status >= 200 && status < 300)
+        return { ok: true };
+    return { ok: false, code: `http_${status}` };
+}
+export function truncateChars(text, maxChars) {
+    const chars = Array.from(text);
+    return chars.length <= maxChars ? text : chars.slice(0, maxChars).join("");
+}

package/dist/delivery/delivery-service.js

@@ -88,16 +88,18 @@ export function createDeliveryService(options) {
             sink: escapeHatchAuditSink,
             log,
         });
-        // Mirrors buildHandlerContext (pipeline/dispatch-shared.ts): a non-systemScope
-        // tenantUserIdsQuery must get the same tenant-filtered db/no-systemDb context
-        // the real dispatcher would give it — handing it "system" mode + a systemDb
-        // view regardless would grant cross-tenant reach the dispatcher never would.
+        // ctx.db/dbOutsideTransaction are tenant-filtered even for a systemScope handler:
+        // the dispatcher closes them off entirely there, so "system" mode would hand this
+        // path a cross-tenant read the dispatcher never allows. Cross-tenant reach only
+        // exists through the grant-carrying systemDb view below.
         const isSystem = registry.isHandlerSystemScoped(tenantUserIdsQuery);
-        const tenantDb = createTenantDb(db, tenantId, isSystem ? "system" : "tenant", undefined, undefined, undefined, { report });
+        const tenantDb = createTenantDb(db, tenantId, "tenant", undefined, undefined, undefined, {
+            report,
+        });
         // The dispatcher grants a systemScope handler's ctx.systemDb.unsafeRaw() ungated —
         // the grant comes from the handler's own r.systemScope() registration, not from this
-        // caller. ctx.db/dbOutsideTransaction stay on the grant-less tenantDb above; only the
-        // systemDb view's own source TenantDb carries the grant, so it can't leak onto ctx.db.
+        // caller. Only the systemDb view's own source TenantDb carries the grant, so it
+        // can't leak onto ctx.db.
         const systemDbSourceTenantDb = isSystem
             ? createTenantDb(db, tenantId, "system", undefined, undefined, undefined, {
                 report,
@@ -227,6 +229,9 @@ export function createDeliveryService(options) {
     async function deliverToUser(userId, notificationType, data, tenantId, priority) {
         const channelCtx = buildChannelContext(db, registry, sseBroker, tenantId);
         for (const channel of channels) {
+            // Route-only channel (no per-user address): not a user-notification target.
+            if (!channel.resolve)
+                continue;
             const message = buildMessage(notificationType, data, channel.name);
             // Kill switch: tenant admin disabled this channel entirely
             if (isChannelKilled) {

package/dist/delivery/index.d.ts

@@ -1,4 +1,6 @@
 export { hashUnsubscribeAddress } from "./address-opt-out.js";
+export { type ChatWebhookChannelOptions, chatMessageText, createChatWebhookChannel, toChannelResult, } from "./chat-webhook-channel.js";
+export { type ChatSendFailureCode, type ChatSendResult, type ChatWebhookRequest, chatConnectionNameSchema, DEFAULT_CHAT_TIMEOUT_MS, postChatWebhook, truncateChars, } from "./chat-webhook-sender.js";
 export type { DeliveryStatusValue } from "./constants.js";
 export { DELIVERY_CHANNEL_EXTENSION, DELIVERY_FEATURE, DELIVERY_LOG_SCREEN_ID, DELIVERY_UNSUBSCRIBE_PATH, DeliveryErrors, DeliveryHandlers, DeliveryJobs, DeliveryQueries, DeliveryStatus, } from "./constants.js";
 export { collectChannels, createDeliveryService, type DeliveryServiceOptions, type KillSwitchResolver, type RateLimitConfig, } from "./delivery-service.js";

package/dist/delivery/index.js

@@ -1,4 +1,6 @@
 export { hashUnsubscribeAddress } from "./address-opt-out.js";
+export { chatMessageText, createChatWebhookChannel, toChannelResult, } from "./chat-webhook-channel.js";
+export { chatConnectionNameSchema, DEFAULT_CHAT_TIMEOUT_MS, postChatWebhook, truncateChars, } from "./chat-webhook-sender.js";
 export { DELIVERY_CHANNEL_EXTENSION, DELIVERY_FEATURE, DELIVERY_LOG_SCREEN_ID, DELIVERY_UNSUBSCRIBE_PATH, DeliveryErrors, DeliveryHandlers, DeliveryJobs, DeliveryQueries, DeliveryStatus, } from "./constants.js";
 export { collectChannels, createDeliveryService, } from "./delivery-service.js";
 export { createDeliveryFeature } from "./feature.js";

package/dist/delivery/jobs.js

@@ -103,7 +103,7 @@ export const deliverySendJob = async (payload, ctx) => {
     const tenantId = p.tenantId; // @cast-boundary engine-payload — stream tenant
     const { db, registry } = requireTenantScopedDeps(ctx, tenantId);
     const channel = resolveChannel(registry, p.channelName);
-    const channelCtx = buildChannelContext(db, registry, undefined, tenantId);
+    const channelCtx = buildChannelContext(db, registry, undefined, tenantId, ctx.secrets);
     try {
         const result = await channel.send(p.address, toMessage(p), channelCtx, p.rendered);
         await appendAttemptEvent(db, registry, p.deliveryAttemptId, entryFor(p, result.status, result.error ?? null, result.address ?? p.address));

package/dist/delivery/testing.d.ts

@@ -1,6 +1,7 @@
 import type { SseBroker } from "@cosmicdrift/kumiko-framework/api";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { EscapeHatchAuditSink, Registry } from "@cosmicdrift/kumiko-framework/engine";
+import type { JobRunner } from "@cosmicdrift/kumiko-framework/jobs";
 import type { Logger } from "@cosmicdrift/kumiko-framework/logging";
 import type { Redis } from "ioredis";
 import type { KillSwitchResolver, RateLimitConfig } from "./delivery-service.js";
@@ -11,6 +12,7 @@ export type CreateDeliveryTestContextOptions = {
     readonly isChannelKilled?: KillSwitchResolver;
     readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
     readonly log?: Logger;
+    readonly jobRunner?: JobRunner;
 };
 /**
  * Helper for setupTestStack: creates a DeliveryService + _notifyFactory for the test context.

package/dist/delivery/types.d.ts

@@ -1,12 +1,14 @@
 import type { SseBroker } from "@cosmicdrift/kumiko-framework/api";
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { NotifyOptions, NotifyPriority, Registry, SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import { DELIVERY_CHANNEL_EXTENSION } from "./constants.js";
 export type ChannelContext = {
     readonly db: TenantDb;
     readonly registry: Registry;
     readonly sseBroker: SseBroker | undefined;
     readonly tenantId: TenantId;
+    readonly secrets?: SecretsContext | undefined;
 };
 export type ChannelMessage = {
     readonly notificationType: string;
@@ -28,7 +30,7 @@ export type DeliveryChannelMode = (typeof DELIVERY_CHANNEL_MODES)[number];
 export type DeliveryChannel = {
     readonly name: string;
     readonly mode: DeliveryChannelMode;
-    resolve(userId: string, ctx: ChannelContext): Promise<string | null>;
+    resolve?(userId: string, ctx: ChannelContext): Promise<string | null>;
     render?(message: ChannelMessage, ctx: ChannelContext): Promise<RenderedMessage>;
     send(address: string, message: ChannelMessage, ctx: ChannelContext, rendered?: RenderedMessage): Promise<ChannelResult>;
 };

package/dist/delivery/types.js

@@ -10,8 +10,7 @@ export function isDeliveryChannelPlugin(o) {
         "mode" in o &&
         DELIVERY_CHANNEL_MODES.some((mode) => mode === o.mode) &&
         (!("render" in o) || o.render === undefined || typeof o.render === "function") &&
-        "resolve" in o &&
-        typeof o.resolve === "function" &&
+        (!("resolve" in o) || o.resolve === undefined || typeof o.resolve === "function") &&
         "send" in o &&
         typeof o.send === "function");
 }

package/dist/document-ingest-foundation/feature.js

@@ -114,8 +114,9 @@ export const documentIngestFoundationFeature = defineFeature(FEATURE_NAME, (r) =
         write: access.roles("TenantAdmin", "SystemAdmin"),
         read: access.roles("TenantAdmin", "SystemAdmin", "User"),
     }));
-    // "fileName" can carry a real person's name; the payload has no user-subject
-    // field to encrypt it under, so piiFields stays "none" for now.
+    // "fileName" can carry a real person's name, but it reaches both events already as the
+    // fileRef's own self-subject ciphertext (copied from fileRef.created/restored), which
+    // append() passes through; shredding the fileRef's key shreds it here too.
     r.defineEvent(DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, documentIngestRequestedPayloadSchema, {
         piiFields: "none",
         version: 2,

package/dist/file-derivatives/handlers/public-variant-by-file-ref.query.js

@@ -16,7 +16,7 @@ export const publicVariantByFileRefQuery = defineQueryHandler({
         reason: BY_FILE_REF_ESCAPE_HATCH_REASON,
     },
     handler: async (query, ctx) => {
-        const db = ctx.db.unsafeRaw(BY_FILE_REF_ESCAPE_HATCH_REASON);
+        const db = ctx.db.unsafeRaw();
         const row = await fetchOne(db, fileRefsTable, {
             id: query.payload.fileRefId,
             isDeleted: false,

package/dist/files-tenant-data/index.js

@@ -34,7 +34,7 @@ export function createFilesTenantDataFeature() {
             escapeHatch: {
                 reason: SWEEP_ORPHANED_DERIVATIVES_ESCAPE_HATCH_REASON,
             },
-            handler: (payload, ctx) => sweepOrphanedDerivativesJob(payload, ctx, ctx.db.unsafeRaw(SWEEP_ORPHANED_DERIVATIVES_ESCAPE_HATCH_REASON)),
+            handler: (payload, ctx) => sweepOrphanedDerivativesJob(payload, ctx, ctx.db.unsafeRaw()),
         });
     });
 }

package/dist/form-draft/feature.js

@@ -38,7 +38,7 @@ function registerFormDraft(r) {
         trigger: { cron: "0 3 * * *" },
         concurrency: "skip",
         escapeHatch: { reason: CLEANUP_ESCAPE_HATCH_REASON },
-        handler: (payload, ctx) => cleanupDraftsJob(payload, ctx, ctx.db.unsafeRaw(CLEANUP_ESCAPE_HATCH_REASON)),
+        handler: (payload, ctx) => cleanupDraftsJob(payload, ctx, ctx.db.unsafeRaw()),
     });
 }
 export const formDraftFeature = defineFeature(FORM_DRAFT_FEATURE_NAME, registerFormDraft);

package/dist/form-draft/handlers/discard.write.js

@@ -29,6 +29,7 @@ export const discardDraftWrite = defineWriteHandler({
     description: "Deletes the calling user's draft for one draftKey and, when releaseFiles is set, hard-deletes the file references that draft alone uploaded; use it after a successful submit or when the user abandons the form.",
     agent: { risk: "high" },
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: DISCARD_DRAFT_FILE_REFS_REASON,
     },
     handler: async (event, ctx) => {
@@ -58,7 +59,7 @@ export const discardDraftWrite = defineWriteHandler({
             // lazily on the first step-change — a file uploaded before that exists
             // predates the draft row, so the insertedAt filter must not apply.
             const isCreateMode = event.payload.draftKey.includes(":new:");
-            const ownedRefs = await filterOwnedFileRefs(ctx.db.unsafeRaw(DISCARD_DRAFT_FILE_REFS_REASON), event.user.tenantId, ownerId, candidateKeys, existing.insertedAt, isCreateMode);
+            const ownedRefs = await filterOwnedFileRefs(ctx.db.unsafeRaw(), event.user.tenantId, ownerId, candidateKeys, existing.insertedAt, isCreateMode);
             // Fail-closed erase of file_refs rows FIRST (outside the best-effort
             // storage-hygiene loop). releaseDraftFileRefs swallows per-key errors
             // by design — routing forget through it would report discarded:true

package/dist/form-draft/handlers/save.write.js

@@ -27,6 +27,7 @@ export const saveDraftWrite = defineWriteHandler({
     access: FORM_DRAFT_ACCESS,
     description: "Upserts the calling user's draft for one draftKey with the given form values and step index, stamping savedAt server-side and refusing a brand-new draft once the per-owner draft cap is reached; use it to persist an in-progress form before the real entity exists.",
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: SAVE_DRAFT_COUNT_REASON,
     },
     handler: async (event, ctx) => {
@@ -41,7 +42,7 @@ export const saveDraftWrite = defineWriteHandler({
         // Cap check only on the create path — an update never grows the number
         // of drafts this owner has, so a user already at the limit can still
         // keep saving their existing drafts.
-        const draftCount = await countDraftsByOwner(ctx.db.unsafeRaw(SAVE_DRAFT_COUNT_REASON), event.user.tenantId, ownerId);
+        const draftCount = await countDraftsByOwner(ctx.db.unsafeRaw(), event.user.tenantId, ownerId);
         if (draftCount >= FORM_DRAFT_MAX_PER_OWNER) {
             return failUnprocessable("draft_limit_reached", { limit: FORM_DRAFT_MAX_PER_OWNER });
         }