@cosmicdrift/kumiko-bundled-features 0.338.0 → 0.339.0

package/dist/inbound-mail-foundation/watch-supervisor.js

@@ -48,9 +48,15 @@ import { configuredPiiSubjectKms, decryptPiiFieldValues, } from "@cosmicdrift/ku
 import { Temporal } from "temporal-polyfill";
 import { InboundMailAccountStatuses, InboundMailFoundationHandlers } from "./constants.js";
 import { MAIL_ACCOUNT_PII_FIELDS, syncCursorTable } from "./entities.js";
+import { createOAuthAccessTokenManager, usesFoundationManagedOAuth, } from "./oauth-access-token.js";
 import { mailAccountsProjectionTable } from "./projection.js";
 import { resolveInboundProviderForAccount } from "./provider-factory.js";
 import { isInboundAuthError, isInboundCursorInvalidError, isInboundRateLimitError, } from "./types.js";
+// Provider errors can embed token or response data in `message`; logs carry
+// only the error class.
+function describeError(err) {
+    return err instanceof Error ? err.name : typeof err;
+}
 const DEFAULT_POLL_INTERVAL_MS = 5 * 60 * 1000;
 const DEFAULT_BACKFILL_WINDOW_DAYS = 30;
 const DEFAULT_MAX_MESSAGES_PER_POLL = 200;
@@ -72,6 +78,25 @@ export function createInboundMailSupervisor(deps) {
     // configured TTL — real deployments (default 90s) never hit it.
     const renewIntervalMs = Math.max(50, Math.floor((leaseTtlSeconds * 1000) / 3));
     const log = deps.log ?? (() => { });
+    const oauthTokens = deps.oauthTokens ??
+        (deps.providerCtx.secrets
+            ? createOAuthAccessTokenManager({
+                db: deps.db,
+                secrets: deps.providerCtx.secrets,
+                providerCtx: deps.providerCtx,
+            })
+            : undefined);
+    // Undefined for non-OAuth accounts. A refresh failure propagates into the
+    // caller's handleSyncError: InboundAuthError → auth_error, anything else
+    // → transient retry.
+    async function resolveAccessToken(account, plugin) {
+        if (!usesFoundationManagedOAuth(account, plugin))
+            return undefined;
+        if (!oauthTokens) {
+            throw new Error("oauth account needs a secrets context for token refresh");
+        }
+        return oauthTokens.getAccessToken(account, plugin);
+    }
     let running = false;
     let pollTimer = null;
     let pollInFlight = null;
@@ -213,7 +238,7 @@ export function createInboundMailSupervisor(deps) {
             return true;
         }
         // Transient/unbekannt: loggen, nächster Tick retried.
-        log(`inbound-mail: account ${account.id} sync error: ${err instanceof Error ? err.message : String(err)}`);
+        log(`inbound-mail: account ${account.id} sync error: ${describeError(err)}`);
         return true;
     }
     // ---------------------------------------------------------------
@@ -225,9 +250,11 @@ export function createInboundMailSupervisor(deps) {
         try {
             // hasMore-Schleife: Pagination innerhalb eines Ticks bis Budget.
             for (;;) {
+                const accessToken = await resolveAccessToken(account, plugin);
                 const result = await plugin.fetch(deps.providerCtx, account, cursor, {
                     backfillWindowDays,
                     maxMessages: budget,
+                    ...(accessToken !== undefined && { accessToken }),
                 });
                 await ingestBatch(account, result.messages, JSON.stringify(result.nextCursor));
                 await saveCursor(account, result.nextCursor);
@@ -249,7 +276,7 @@ export function createInboundMailSupervisor(deps) {
                 plugin = resolveInboundProviderForAccount(deps.providerCtx, account);
             }
             catch (err) {
-                log(`inbound-mail: ${err instanceof Error ? err.message : String(err)}`);
+                log(`inbound-mail: ${describeError(err)}`);
                 continue;
             }
             await pollAccount(account, plugin);
@@ -290,7 +317,7 @@ export function createInboundMailSupervisor(deps) {
             renewed = await deps.lock.renew(account.id, state.lockToken, leaseTtlSeconds);
         }
         catch (err) {
-            log(`inbound-mail: watch lease renew for account ${account.id} failed: ${err instanceof Error ? err.message : String(err)}`);
+            log(`inbound-mail: watch lease renew for account ${account.id} failed: ${describeError(err)}`);
             state.renewFailures += 1;
             // After failures spanning a full lease TTL, tear down — otherwise a
             // peer can acquire the expired key while we still hold an IDLE conn.
@@ -379,7 +406,7 @@ export function createInboundMailSupervisor(deps) {
             state.stop = null;
             const delay = state.backoffMs;
             state.backoffMs = Math.min(state.backoffMs * 2, backoffMaxMs);
-            log(`inbound-mail: watch for account ${account.id} died (${err instanceof Error ? err.message : String(err)}) — restart in ${delay}ms`);
+            log(`inbound-mail: watch for account ${account.id} died (${describeError(err)}) — restart in ${delay}ms`);
             void markAccount(account, { watchState: `backoff:${delay}ms` }, "watch_supervisor");
             state.restartTimer = setTimeout(() => {
                 state.restartTimer = null;
@@ -388,27 +415,28 @@ export function createInboundMailSupervisor(deps) {
         };
         state.starting = true;
         try {
+            const accessToken = await resolveAccessToken(account, plugin);
             const stop = await plugin.watch(deps.providerCtx, account, {
                 onMessages: async (msgs) => {
                     try {
                         await ingestBatch(account, msgs, "watch");
                     }
                     catch (err) {
-                        // Ingest-Fehler killt den Watcher nicht — der Poll holt die
-                        // Messages beim nächsten Tick (Dedup macht's idempotent).
-                        log(`inbound-mail: watch-ingest for account ${account.id} failed: ${err instanceof Error ? err.message : String(err)}`);
+                        // An ingest failure must not kill the watcher: the next poll
+                        // tick fetches the messages again and dedup keeps it idempotent.
+                        log(`inbound-mail: watch-ingest for account ${account.id} failed: ${describeError(err)}`);
                     }
                 },
                 onError: (err) => {
                     void (async () => {
                         const keepRunning = await handleSyncError(account, err);
-                        // auth_error → stopWatcher hat die generation gebumpt,
-                        // scheduleRestart no-op't; für alle anderen: Backoff-Restart.
+                        // On auth_error stopWatcher already bumped the generation, so
+                        // scheduleRestart is a no-op; every other error restarts with backoff.
                         if (keepRunning)
                             scheduleRestart(err);
                     })();
                 },
-            });
+            }, accessToken !== undefined ? { accessToken } : undefined);
             if (state.generation !== generation || !running) {
                 await stop();
                 // skip: stop() kam während des Connects — Watcher wurde sofort wieder abgebaut.
@@ -425,7 +453,7 @@ export function createInboundMailSupervisor(deps) {
                 await markAccount(account, { watchState: "watching" }, "watch_supervisor");
             }
             catch (err) {
-                log(`inbound-mail: markAccount(watching) for account ${account.id} failed: ${err instanceof Error ? err.message : String(err)}`);
+                log(`inbound-mail: markAccount(watching) for account ${account.id} failed: ${describeError(err)}`);
             }
         }
         catch (err) {
@@ -464,7 +492,7 @@ export function createInboundMailSupervisor(deps) {
                 await stop();
             }
             catch (err) {
-                log(`inbound-mail: stop watcher ${accountId} failed: ${err instanceof Error ? err.message : String(err)}`);
+                log(`inbound-mail: stop watcher ${accountId} failed: ${describeError(err)}`);
             }
         }
         if (deps.lock && lockToken) {
@@ -472,7 +500,7 @@ export function createInboundMailSupervisor(deps) {
                 await deps.lock.release(accountId, lockToken);
             }
             catch (err) {
-                log(`inbound-mail: watch lease release for account ${accountId} failed: ${err instanceof Error ? err.message : String(err)}`);
+                log(`inbound-mail: watch lease release for account ${accountId} failed: ${describeError(err)}`);
             }
         }
     }
@@ -486,7 +514,7 @@ export function createInboundMailSupervisor(deps) {
         pollTimer = setTimeout(() => {
             pollTimer = null;
             pollInFlight = pollOnce()
-                .catch((err) => log(`inbound-mail: poll tick failed: ${err instanceof Error ? err.message : String(err)}`))
+                .catch((err) => log(`inbound-mail: poll tick failed: ${describeError(err)}`))
                 .finally(() => {
                 pollInFlight = null;
                 scheduleNextPoll();

package/dist/managed-pages/handlers/set.write.js

@@ -54,7 +54,7 @@ export const setWrite = defineWriteHandler({
         // on both the existing-check and the executor's stream reads; re-scope to the target.
         // Safe: the override branch is SystemAdmin-gated above.
         const scopedDb = override !== undefined
-            ? createTenantDb(db.unsafeRaw(SET_PAGE_TENANT_OVERRIDE_REASON), override, // @cast-boundary engine-bridge
+            ? createTenantDb(db.unsafeRaw(), override, // @cast-boundary engine-bridge
             "tenant")
             : db;
         const existing = await fetchOne(scopedDb, pagesTable, {

package/dist/notes-history/handlers/add-note.write.js

@@ -54,7 +54,7 @@ export function createAddNoteHandler(access = DEFAULT_NOTES_HISTORY_ACCESS, entr
                 // Bun.SQL poisons the whole tx after any error inside it, even one that's
                 // caught — so the lookup runs in a savepoint where available, otherwise directly
                 // (pool statements are their own units).
-                authorName = await runInSavepointIfSupported(ctx.db.unsafeRaw(READ_AUTHOR_DISPLAY_NAME_REASON), async (sp) => {
+                authorName = await runInSavepointIfSupported(ctx.db.unsafeRaw(), async (sp) => {
                     const userRow = await fetchOne(sp, userTable, {
                         id: event.user.id,
                     });

package/dist/renderer-simple/feature.d.ts

@@ -1,4 +1,10 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import type { NotificationRenderer } from "../delivery/index.js";
 import { type RendererContext, type RenderRequest, type RenderResponse } from "../renderer-foundation/index.js";
-export declare function adaptToFoundation(req: RenderRequest, ctx: RendererContext): Promise<RenderResponse>;
-export declare function createRendererSimpleFeature(): FeatureDefinition;
+import { type MailBranding } from "./simple-renderer.js";
+export declare function adaptToFoundation(req: RenderRequest, ctx: RendererContext, renderer?: NotificationRenderer): Promise<RenderResponse>;
+export type RendererSimpleOptions = {
+    /** Branding applied to every notification mail, including the framework auth mails. */
+    readonly mailBranding?: MailBranding;
+};
+export declare function createRendererSimpleFeature(options?: RendererSimpleOptions): FeatureDefinition;

package/dist/renderer-simple/feature.js

@@ -1,7 +1,7 @@
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { RENDERER_EXTENSION, RendererError, } from "../renderer-foundation/index.js";
 import { resolveNotificationVariables } from "./resolve-variables.js";
-import { simpleRenderer } from "./simple-renderer.js";
+import { createSimpleRenderer, simpleRenderer } from "./simple-renderer.js";
 // Adapter: simpleRenderer.render hat `Promise<string>`-Signatur (Legacy
 // NotificationRenderer-Contract), renderer-foundation erwartet
 // `Promise<RenderResponse>` mit discriminated union. Mapper bewahrt
@@ -9,20 +9,23 @@ import { simpleRenderer } from "./simple-renderer.js";
 // Inline-CSS) und packt sie in den RendererPlugin-Contract.
 //
 // Exported damit der Adapter-Pfad direkt testbar ist (unit-test).
-export async function adaptToFoundation(req, ctx) {
+export async function adaptToFoundation(req, ctx, renderer = simpleRenderer) {
     if (req.kind !== "notification") {
         // Defensiver Guard — Foundation wählt Plugins nur für matching kinds,
         // dieser Pfad sollte unter normalen Umständen nie erreicht werden.
         throw new RendererError(`renderer-simple supports only kind="notification", got "${req.kind}"`, "invalid_payload");
     }
     const variables = await resolveNotificationVariables(req, ctx);
-    const html = await simpleRenderer.render({
+    const html = await renderer.render({
         template: req.payload.template ?? "",
         variables,
     });
     return { kind: "notification", html };
 }
-export function createRendererSimpleFeature() {
+export function createRendererSimpleFeature(options) {
+    const renderer = options?.mailBranding
+        ? createSimpleRenderer(options.mailBranding)
+        : simpleRenderer;
     return defineFeature("renderer-simple", (r) => {
         r.describe('Default renderer plugin for `kind="notification"`: takes a structured `EmailTemplateData` variable map (with `header`, `sections[]` of text/button objects, and optional `footer`; falls back to `title`/`body` if no structured fields are present) and returns rendered HTML with inline CSS. Requires `renderer-foundation`; sufficient for plain notification emails \u2014 swap it for `renderer-mail-html` if you need MJML/Markdown layouts.');
         r.uiHints({
@@ -34,7 +37,7 @@ export function createRendererSimpleFeature() {
         r.optionalRequires("template-resolver");
         r.useExtension(RENDERER_EXTENSION, "simple", {
             kinds: ["notification"],
-            render: adaptToFoundation,
+            render: (req, ctx) => adaptToFoundation(req, ctx, renderer),
         });
     });
 }

package/dist/renderer-simple/index.d.ts

@@ -1,2 +1,2 @@
-export { createRendererSimpleFeature } from "./feature.js";
-export { simpleRenderer } from "./simple-renderer.js";
+export { createRendererSimpleFeature, type RendererSimpleOptions } from "./feature.js";
+export { createSimpleRenderer, type MailBranding, simpleRenderer } from "./simple-renderer.js";

package/dist/renderer-simple/index.js

@@ -1,2 +1,2 @@
 export { createRendererSimpleFeature } from "./feature.js";
-export { simpleRenderer } from "./simple-renderer.js";
+export { createSimpleRenderer, simpleRenderer } from "./simple-renderer.js";

package/dist/renderer-simple/simple-renderer.d.ts

@@ -1,2 +1,17 @@
 import type { NotificationRenderer } from "../delivery/index.js";
+export type MailBranding = {
+    /** Shown as text when there is no logo, and as the logo alt text. */
+    readonly productName?: string;
+    /** Hex color (#rgb, #rrggbb, #rrggbbaa); used for buttons and the header accent. */
+    readonly primaryColor?: string;
+    /** Absolute http(s) URL; anything else is dropped. */
+    readonly logoUrl?: string;
+    readonly footerText?: string;
+    /** Absolute http(s) URLs only; other entries are dropped. */
+    readonly footerLinks?: readonly {
+        readonly label: string;
+        readonly url: string;
+    }[];
+};
+export declare function createSimpleRenderer(branding?: MailBranding): NotificationRenderer;
 export declare const simpleRenderer: NotificationRenderer;

package/dist/renderer-simple/simple-renderer.js

@@ -1,37 +1,84 @@
-import { escapeHtml } from "@cosmicdrift/kumiko-headless";
-function renderSection(section) {
+import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+const DEFAULT_PRIMARY_COLOR = "#2563eb";
+const HEX_COLOR_PATTERN = /^#(?:[0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/;
+function isHttpUrl(value) {
+    try {
+        const { protocol } = new URL(value);
+        return protocol === "http:" || protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}
+function resolvePrimaryColor(branding) {
+    const color = branding?.primaryColor;
+    return color && HEX_COLOR_PATTERN.test(color) ? color : DEFAULT_PRIMARY_COLOR;
+}
+function renderBrandingHeader(branding, primaryColor) {
+    if (!branding)
+        return "";
+    const logoUrl = branding.logoUrl && isHttpUrl(branding.logoUrl) ? branding.logoUrl : undefined;
+    if (!logoUrl && !branding.productName)
+        return "";
+    const logo = logoUrl
+        ? `<img src="${escapeHtmlAttr(logoUrl)}" alt="${escapeHtmlAttr(branding.productName ?? "")}" style="display:block;max-height:40px;max-width:200px;border:0" />`
+        : `<span style="font-size:18px;font-weight:700;color:${escapeHtmlAttr(primaryColor)}">${escapeHtml(branding.productName ?? "")}</span>`;
+    return `<div style="margin:0 0 24px;padding:0 0 16px;border-bottom:3px solid ${escapeHtmlAttr(primaryColor)}">${logo}</div>`;
+}
+function renderBrandingFooter(branding) {
+    if (!branding)
+        return "";
+    const links = (branding.footerLinks ?? [])
+        .filter((link) => isHttpUrl(link.url))
+        .map((link) => `<a href="${escapeHtmlAttr(link.url)}" style="color:#999">${escapeHtml(link.label)}</a>`);
+    const footerPartsHtml = [
+        branding.footerText ? escapeHtml(branding.footerText) : "",
+        links.join(" · "),
+    ].filter((part) => part !== "");
+    if (footerPartsHtml.length === 0)
+        return "";
+    const footerHtml = footerPartsHtml.join("<br />");
+    return `<p style="margin:16px 0 0;color:#999;font-size:12px">${footerHtml}</p>`;
+}
+function renderSection(section, primaryColor) {
     if ("text" in section) {
         return `<p style="margin:0 0 16px;color:#333;font-size:14px;line-height:1.5">${escapeHtml(section.text)}</p>`;
     }
     if ("button" in section) {
-        return `<p style="margin:0 0 16px"><a href="${escapeHtml(section.button.url)}" style="display:inline-block;padding:10px 24px;background:#2563eb;color:#fff;text-decoration:none;border-radius:4px;font-size:14px">${escapeHtml(section.button.label)}</a></p>`;
+        return `<p style="margin:0 0 16px"><a href="${escapeHtml(section.button.url)}" style="display:inline-block;padding:10px 24px;background:${escapeHtmlAttr(primaryColor)};color:#fff;text-decoration:none;border-radius:4px;font-size:14px">${escapeHtml(section.button.label)}</a></p>`;
     }
     return "";
 }
 // Simple Renderer: turns structured email template data into HTML with inline CSS.
 // No external dependencies, no template engine — just string concatenation.
-export const simpleRenderer = {
-    name: "simple",
-    async render(input) {
-        const data = input.variables; // @cast-boundary render-helper
-        // Fallback: if no structured fields, use title + body as header + single text section
-        const header = data.header ?? data.title;
-        const sections = data.sections ?? (data.body ? [{ text: data.body }] : undefined);
-        const parts = [];
-        parts.push('<!DOCTYPE html><html><body style="margin:0;padding:0;font-family:sans-serif">');
-        parts.push('<div style="max-width:600px;margin:0 auto;padding:24px">');
-        if (header) {
-            parts.push(`<h1 style="margin:0 0 24px;color:#111;font-size:20px;font-weight:600">${escapeHtml(header)}</h1>`);
-        }
-        if (sections) {
-            for (const section of sections) {
-                parts.push(renderSection(section));
+export function createSimpleRenderer(branding) {
+    const primaryColor = resolvePrimaryColor(branding);
+    return {
+        name: "simple",
+        async render(input) {
+            const data = input.variables; // @cast-boundary render-helper
+            // Fallback: if no structured fields, use title + body as header + single text section
+            const header = data.header ?? data.title;
+            const sections = data.sections ?? (data.body ? [{ text: data.body }] : undefined);
+            const parts = [];
+            parts.push('<!DOCTYPE html><html><body style="margin:0;padding:0;font-family:sans-serif">');
+            parts.push('<div style="max-width:600px;margin:0 auto;padding:24px">');
+            parts.push(renderBrandingHeader(branding, primaryColor));
+            if (header) {
+                parts.push(`<h1 style="margin:0 0 24px;color:#111;font-size:20px;font-weight:600">${escapeHtml(header)}</h1>`);
+            }
+            if (sections) {
+                for (const section of sections) {
+                    parts.push(renderSection(section, primaryColor));
+                }
             }
-        }
-        if (data.footer) {
-            parts.push(`<p style="margin:24px 0 0;color:#999;font-size:12px;border-top:1px solid #eee;padding-top:16px">${escapeHtml(data.footer)}</p>`);
-        }
-        parts.push("</div></body></html>");
-        return parts.join("");
-    },
-};
+            if (data.footer) {
+                parts.push(`<p style="margin:24px 0 0;color:#999;font-size:12px;border-top:1px solid #eee;padding-top:16px">${escapeHtml(data.footer)}</p>`);
+            }
+            parts.push(renderBrandingFooter(branding));
+            parts.push("</div></body></html>");
+            return parts.join("");
+        },
+    };
+}
+export const simpleRenderer = createSimpleRenderer();

package/dist/secrets/feature.js

@@ -135,7 +135,7 @@ export function createSecretsFeature(opts = {}) {
             escapeHatch: {
                 reason: ROTATE_ESCAPE_HATCH_REASON,
             },
-            handler: (payload, ctx) => rotateJob(payload, ctx, ctx.db.unsafeRaw(ROTATE_ESCAPE_HATCH_REASON)),
+            handler: (payload, ctx) => rotateJob(payload, ctx, ctx.db.unsafeRaw()),
         });
         // Pre-ES had a separate `retention-cleanup` job scrubbing the audit
         // table on a compliance-driven schedule (90d default). Post-ES the

package/dist/sessions/feature.js

@@ -121,7 +121,7 @@ export function createSessionsFeature(options) {
             name: "cleanup",
             trigger: { manual: true },
             escapeHatch: { reason: CLEANUP_ESCAPE_HATCH_REASON },
-            handler: (payload, ctx) => cleanupJob(payload, ctx, ctx.db.unsafeRaw(CLEANUP_ESCAPE_HATCH_REASON)),
+            handler: (payload, ctx) => cleanupJob(payload, ctx, ctx.db.unsafeRaw()),
         });
         // Cross-feature entity hook on "user". `r.entityHook` (NOT `r.hook`) is
         // the supported cross-feature path: entity-keyed, not prefixed by the

package/dist/sessions/handlers/revoke-all-for-user.write.js

@@ -41,7 +41,7 @@ export const revokeAllForUserWrite = defineWriteHandler({
         reason: REVOKE_ALL_SESSIONS_REASON,
     },
     handler: async (event, ctx) => {
-        const runner = ctx.db.unsafeRaw(REVOKE_ALL_SESSIONS_REASON);
+        const runner = ctx.db.unsafeRaw();
         const updated = await updateMany(runner, userSessionTable, { revokedAt: Temporal.Now.instant() }, {
             userId: event.payload.userId,
             revokedAt: null,

package/dist/tenant-handover/handlers/claim.write.js

@@ -36,8 +36,7 @@ export function createClaimTenantHandoverHandler(opts = {}) {
         agent: { expose: false },
         rateLimit: { per: "user", limit: 10, windowSeconds: 60 },
         handler: async (event, ctx) => {
-            const db = ctx.db.unsafeRaw("tenant-handover claim: cross-tenant read + ownership write, legitimized by the " +
-                "row-bound grant redeemed below");
+            const db = ctx.db.unsafeRaw();
             const rootLocation = resolveRootAnchorLocation(ctx.registry, db, event.payload.entityType);
             if (!rootLocation)
                 return notTransferable(event.payload.entityType);

package/dist/tenant-lifecycle/feature.js

@@ -74,7 +74,7 @@ export function createTenantLifecycleFeature() {
                 }
                 const T = (await import("@cosmicdrift/kumiko-framework/time")).getTemporal();
                 await runTenantDestructionSweep({
-                    db: ctx.db.unsafeRaw(RUN_TENANT_DESTRUCTION_REASON), // @cast-boundary db-operator — jobs never run inside a DbTx
+                    db: ctx.db.unsafeRaw(), // @cast-boundary db-operator — jobs never run inside a DbTx
                     registry: ctx.registry,
                     now: T.Now.instant(),
                     log: (message) => ctx.log?.warn(message),

package/dist/tenant-lifecycle/handlers/cancel-destruction.write.js

@@ -20,7 +20,9 @@ export const cancelDestructionWrite = defineWriteHandler({
     },
     handler: async (event, ctx) => {
         const tenantId = event.user.tenantId;
-        const row = await fetchOne(ctx.db.unsafeRaw(CANCEL_DESTRUCTION_TENANT_ROW_REASON), tenantTable, { id: tenantId });
+        const row = await fetchOne(ctx.db.unsafeRaw(), tenantTable, {
+            id: tenantId,
+        });
         if (!row) {
             return writeFailure(new UnprocessableError("tenant_not_found", { details: { tenantId } }));
         }

package/dist/tenant-lifecycle/handlers/request-destruction.write.js

@@ -24,7 +24,7 @@ export const requestDestructionWrite = defineWriteHandler({
     },
     handler: async (event, ctx) => {
         const tenantId = event.user.tenantId;
-        const runner = ctx.db.unsafeRaw(REQUEST_DESTRUCTION_TENANT_ROW_REASON);
+        const runner = ctx.db.unsafeRaw();
         const row = await fetchOne(runner, tenantTable, { id: tenantId });
         if (!row) {
             return writeFailure(new UnprocessableError("tenant_not_found", { details: { tenantId } }));

package/dist/tier-engine/feature.js

@@ -303,7 +303,7 @@ export function createTierEngineFeature(opts = {}) {
                 const rawDb = ctx.systemDb
                     ? ctx.systemDb.unsafeRaw(autoDefaultTierHookReason)
                     : ctx.db && "unsafeRaw" in ctx.db
-                        ? ctx.db.unsafeRaw(autoDefaultTierHookReason)
+                        ? ctx.db.unsafeRaw()
                         : undefined;
                 // skip: defensive — inTransaction phase always sets db, but AppContext's
                 // type makes it optional. Throwing would be overreach (lifecycle

package/dist/tier-engine/handlers/get-tenant-tier.query.js

@@ -20,7 +20,7 @@ export const getTenantTierQuery = defineQueryHandler({
     },
     handler: async (query, ctx) => {
         const tenantId = query.payload.tenantId; // @cast-boundary engine-bridge
-        const tdb = createTenantDb(ctx.db.unsafeRaw(GET_TENANT_TIER_REASON), tenantId, "system");
+        const tdb = createTenantDb(ctx.db.unsafeRaw(), tenantId, "system");
         const row = await fetchOne(tdb, tierAssignmentTable, { tenantId });
         return row ?? null;
     },

package/dist/tier-engine/handlers/set-tenant-tier.write.js

@@ -51,7 +51,7 @@ export function createSetTenantTierWrite(opts = {}) {
         },
         handler: async (event, ctx) => {
             const tenantId = event.payload.tenantId; // @cast-boundary engine-bridge
-            const rawDb = ctx.db.unsafeRaw(SET_TENANT_TIER_REASON);
+            const rawDb = ctx.db.unsafeRaw();
             const tdb = createTenantDb(rawDb, tenantId, "system");
             const systemUser = { ...event.user, tenantId };
             const tier = event.payload.tier;

package/dist/user-data-rights/feature.js

@@ -411,7 +411,7 @@ export function createUserDataRightsFeature(opts = {}) {
                 // Discriminator wird via handlerName="user-data-rights:run-export-
                 // jobs" im Secret-Read-Audit erfasst.
                 const exportUserId = ctx._userId ?? SYSTEM_USER_ID;
-                const exportDb = ctx.db.unsafeRaw(RUN_EXPORT_JOBS_REASON); // @cast-boundary db-operator — jobs never run inside a DbTx
+                const exportDb = ctx.db.unsafeRaw(); // @cast-boundary db-operator — jobs never run inside a DbTx
                 const exportRegistry = ctx.registry;
                 // JobContext carries ctx.meter (raw), not ctx.metrics — that bound
                 // handle only exists on HandlerContext (built per write/query call
@@ -496,7 +496,7 @@ export function createUserDataRightsFeature(opts = {}) {
                 }
                 const T = (await import("@cosmicdrift/kumiko-framework/time")).getTemporal();
                 const forgetUserId = ctx._userId ?? SYSTEM_USER_ID;
-                const forgetDb = ctx.db.unsafeRaw(RUN_FORGET_CLEANUP_REASON); // @cast-boundary db-operator — jobs never run inside a DbTx
+                const forgetDb = ctx.db.unsafeRaw(); // @cast-boundary db-operator — jobs never run inside a DbTx
                 const forgetRegistry = ctx.registry;
                 const tenantModel = await resolveAppTenantModel({
                     registry: forgetRegistry,

package/dist/user-data-rights/handlers/cancel-deletion.write.js

@@ -45,7 +45,7 @@ export const cancelDeletionWrite = defineWriteHandler({
         if (!isWithinGracePeriod(row.gracePeriodEnd)) {
             return writeFailure(new UnprocessableError("grace_period_expired"));
         }
-        await updateUserLifecycle(ctx.db.unsafeRaw(APPEND_LIFECYCLE_EVENT_REASON), event.user.id, {
+        await updateUserLifecycle(ctx.db.unsafeRaw(), event.user.id, {
             status: USER_STATUS.Active,
             gracePeriodEnd: null,
             // #354/1: closes the replay-after-cancel window — a still-TTL-valid email

package/dist/user-data-rights/handlers/confirm-deletion-by-token.write.js

@@ -68,7 +68,7 @@ export function createConfirmDeletionByTokenHandler(opts = {}) {
                 secret: opts.deletionTokenSecret,
                 loadPendingRequestId: (userId) => readPendingDeletionRequestId(ctx, userId),
                 commitDeletion: async (userId, requestId) => {
-                    const res = await startDeletionGracePeriod(ctx, userId, () => resolveGracePeriod(ctx, event.user.tenantId), ctx.db.unsafeRaw("appends the user lifecycle event on the SYSTEM_TENANT_ID user stream"), { pendingDeletionRequestId: requestId });
+                    const res = await startDeletionGracePeriod(ctx, userId, () => resolveGracePeriod(ctx, event.user.tenantId), ctx.db.unsafeRaw(), { pendingDeletionRequestId: requestId });
                     if (!res.ok)
                         return false;
                     gracePeriodEndIso = res.gracePeriodEnd.toString();

package/dist/user-data-rights/handlers/download-by-job.query.js

@@ -61,7 +61,7 @@ export const downloadByJobQuery = defineQueryHandler({
         // Wert (603/2).
         const auditIp = requestContext.get()?.ip ?? null;
         const auditUa = requestContext.get()?.userAgent ?? null;
-        const runner = ctx.db.unsafeRaw(DOWNLOAD_BY_JOB_REASON);
+        const runner = ctx.db.unsafeRaw();
         // Step 1-2: job-lookup + cross-user-isolation
         const jobRow = await fetchOne(runner, exportJobsTable, { id: jobId });
         if (!jobRow || jobRow.userId !== userId) {

package/dist/user-data-rights/handlers/download-by-token.query.js

@@ -64,7 +64,7 @@ export const downloadByTokenQuery = defineQueryHandler({
     handler: async (query, ctx) => {
         const T = getTemporal();
         const now = T.Now.instant();
-        const runner = ctx.db.unsafeRaw(DOWNLOAD_BY_TOKEN_REASON);
+        const runner = ctx.db.unsafeRaw();
         // Step 1: hash + lookup
         const hash = await hashDownloadToken(query.payload.token);
         const tokenRow = await fetchOne(runner, exportDownloadTokensTable, {

package/dist/user-data-rights/handlers/export-status.query.js

@@ -30,7 +30,7 @@ export const exportStatusQuery = defineQueryHandler({
         reason: EXPORT_STATUS_REASON,
     },
     handler: async (query, ctx) => {
-        const rows = await selectMany(ctx.db.unsafeRaw(EXPORT_STATUS_REASON), exportJobsTable, { userId: query.user.id }, { limit: 1, orderBy: { col: "requestedAt", direction: "desc" } });
+        const rows = await selectMany(ctx.db.unsafeRaw(), exportJobsTable, { userId: query.user.id }, { limit: 1, orderBy: { col: "requestedAt", direction: "desc" } });
         const latest = rows[0];
         if (!latest)
             return { hasJob: false };

package/dist/user-data-rights/handlers/lift-restriction.write.js

@@ -5,8 +5,6 @@ import { USER_STATUS, userTable } from "../../user/index.js";
 import { denyIfTargetOutsideAdminTenant } from "../lib/deny-if-target-outside-admin-tenant.js";
 import { updateUserLifecycle } from "../lib/update-user-lifecycle.js";
 const LIFT_RESTRICTION_ESCAPE_HATCH_REASON = "checks the target user's membership in the admin's tenant and appends the user lifecycle status change on the SYSTEM_TENANT_ID user stream, both via DbRunner helpers outside the admin's own tenant scope.";
-const CHECK_TARGET_MEMBERSHIP_REASON = "checks the target user's membership in the admin's tenant via the DbRunner helper";
-const APPEND_LIFECYCLE_EVENT_REASON = "appends the user lifecycle event on the SYSTEM_TENANT_ID user stream";
 // POST /api/user/lift-restriction (S2.U6) — DSGVO Art. 18 Reverse.
 //
 // Operator-only. A Restricted user's own session is unconditionally
@@ -38,7 +36,7 @@ export const liftRestrictionWrite = defineWriteHandler({
     },
     handler: async (event, ctx) => {
         const targetUserId = event.payload.userId;
-        const outside = await denyIfTargetOutsideAdminTenant(ctx.db.unsafeRaw(CHECK_TARGET_MEMBERSHIP_REASON), event.user, targetUserId);
+        const outside = await denyIfTargetOutsideAdminTenant(ctx.db.unsafeRaw(), event.user, targetUserId);
         if (outside)
             return outside;
         const userRow = await ctx.db.global(userTable).fetchOne({
@@ -55,7 +53,7 @@ export const liftRestrictionWrite = defineWriteHandler({
                 details: { currentStatus },
             }));
         }
-        await updateUserLifecycle(ctx.db.unsafeRaw(APPEND_LIFECYCLE_EVENT_REASON), targetUserId, {
+        await updateUserLifecycle(ctx.db.unsafeRaw(), targetUserId, {
             status: USER_STATUS.Active,
         });
         return {

package/dist/user-data-rights/handlers/my-audit-log.query.js

@@ -53,7 +53,7 @@ export const myAuditLogQuery = defineQueryHandler({
         }
         if (p.before)
             where["id"] = { lt: BigInt(p.before) };
-        const rows = await selectMany(ctx.db.unsafeRaw(MY_AUDIT_LOG_REASON), eventsTable, where, {
+        const rows = await selectMany(ctx.db.unsafeRaw(), eventsTable, where, {
             orderBy: { col: "id", direction: "desc" },
             limit: p.limit,
         });

package/dist/user-data-rights/handlers/request-deletion-by-email.write.js

@@ -57,7 +57,7 @@ export function createRequestDeletionByEmailHandler(opts = {}) {
             // user-Row landet und in die Token-HMAC-Purpose gefaltet wird. cancel
             // nullt sie → ein nach Cancel nachgespieltes Token verifiziert nicht mehr.
             const requestId = crypto.randomUUID();
-            await updateUserLifecycle(ctx.db.unsafeRaw(APPEND_LIFECYCLE_EVENT_REASON), userRow["id"], {
+            await updateUserLifecycle(ctx.db.unsafeRaw(), userRow["id"], {
                 pendingDeletionRequestId: requestId,
             });
             const { token, expiresAt } = signDeletionToken(userRow["id"], requestId, DELETION_VERIFY_TTL_MINUTES, opts.deletionTokenSecret);

package/dist/user-data-rights/handlers/request-deletion.write.js

@@ -29,7 +29,7 @@ export function createRequestDeletionHandler(opts = {}) {
         description: "Starts the GDPR Art. 17 deletion of the calling user's own account by arming the grace period from the tenant compliance profile and mailing a confirmation, after which only cancel-deletion can stop the erasure.",
         agent: { risk: "high" },
         handler: async (event, ctx) => {
-            const res = await startDeletionGracePeriod(ctx, event.user.id, () => resolveGracePeriod(ctx, event.user.tenantId), ctx.db.unsafeRaw("appends the user lifecycle event on the SYSTEM_TENANT_ID user stream"));
+            const res = await startDeletionGracePeriod(ctx, event.user.id, () => resolveGracePeriod(ctx, event.user.tenantId), ctx.db.unsafeRaw());
             if (!res.ok)
                 return writeFailure(res.error);
             const { gracePeriodEnd, userEmail, userLocale } = res;