@cosmicdrift/kumiko-bundled-features 0.354.0 → 0.355.0

package/dist/agent-tools/agent-manifest.js

@@ -163,6 +163,7 @@ function buildHandlerEntry(qn, kind, def, roles, getHandlerEntity, denyQns) {
         return undefined;
     }
     const entity = getHandlerEntity(qn);
+    const excludedFields = "excludedFields" in def ? def.excludedFields : undefined;
     return {
         qn,
         kind,
@@ -170,6 +171,7 @@ function buildHandlerEntry(qn, kind, def, roles, getHandlerEntity, denyQns) {
         risk: exposure.risk,
         inputSchema,
         ...(entity !== undefined && { entity }),
+        ...(excludedFields !== undefined && { excludedFields }),
     };
 }
 function buildHandlers(queryHandlers, writeHandlers, roles, getHandlerEntity, denyQns) {

package/dist/agent-tools/types.d.ts

@@ -130,6 +130,8 @@ export type AgentManifestHandler = {
     readonly risk: AgentRisk;
     readonly inputSchema: Readonly<Record<string, unknown>>;
     readonly entity?: string;
+    /** Fields this generic create/update handler never writes; sending one fails validation. */
+    readonly excludedFields?: readonly string[];
 };
 export type AgentManifestScreen = {
     readonly id: string;

package/dist/audit/escape-hatch-audit-sink.d.ts

@@ -15,6 +15,7 @@ export declare const escapeHatchUsedSchema: z.ZodObject<{
     }>;
     reason: z.ZodString;
     actor: z.ZodString;
+    caller: z.ZodOptional<z.ZodString>;
     targetUserId: z.ZodOptional<z.ZodString>;
     targetTenantId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;

package/dist/audit/escape-hatch-audit-sink.js

@@ -18,6 +18,7 @@ export const escapeHatchUsedSchema = z.object({
     kind: z.enum(escapeHatchKinds),
     reason: z.string(),
     actor: z.string(),
+    caller: z.string().optional(),
     targetUserId: z.string().optional(),
     targetTenantId: z.string().optional(),
 });
@@ -28,6 +29,7 @@ export function createEscapeHatchAuditSink(opts) {
             kind: event.kind,
             reason: event.reason,
             actor: event.actor,
+            ...(event.caller !== undefined && { caller: event.caller }),
             ...(event.target && { targetUserId: event.target.id, targetTenantId: event.target.tenantId }),
         });
         // Appends on the unbound pool, never the handler tx — an audit entry must

package/dist/audit/handlers/resolve-audit-tenant.js

@@ -1,4 +1,5 @@
-import { crossTenantOverrideDenied } from "@cosmicdrift/kumiko-framework/engine";
+import { mayOverrideTenant } from "@cosmicdrift/kumiko-framework/engine";
+import { AccessDeniedError, FrameworkReasons } from "@cosmicdrift/kumiko-framework/errors";
 import { APP_INSTANCE_STREAM_TYPE } from "@cosmicdrift/kumiko-framework/event-store";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-types/identifiers";
 import { AuditScopes } from "../constants.js";
@@ -7,8 +8,11 @@ import { AuditScopes } from "../constants.js";
 export function resolveAuditScopeFilter(user, scope) {
     if (scope !== AuditScopes.system)
         return { tenantId: user.tenantId };
-    const denied = crossTenantOverrideDenied(user, SYSTEM_TENANT_ID, "audit.errors.systemScopeRequiresSystemAdmin");
-    if (denied)
-        throw denied;
+    if (!mayOverrideTenant(user)) {
+        throw new AccessDeniedError({
+            i18nKey: "audit.errors.systemScopeRequiresSystemAdmin",
+            details: { reason: FrameworkReasons.tenantOverrideRequiresSystemAdmin },
+        });
+    }
     return { tenantId: SYSTEM_TENANT_ID, aggregateType: APP_INSTANCE_STREAM_TYPE };
 }

package/dist/billing-foundation/consumer-protection/register-consent.js

@@ -1,4 +1,3 @@
-import { createSystemUser } from "@cosmicdrift/kumiko-framework/engine";
 import { paymentAggregateId, subscriptionAggregateId } from "../aggregate-id.js";
 import { SubscriptionFoundationHandlers, SubscriptionStatuses } from "../constants.js";
 import { CHECKOUT_CONSENT_RECORDED_EVENT_SHORT, CONTRACT_CONFIRMATION_ISSUED_EVENT_SHORT, checkoutConsentRecordedPayloadSchema, contractConfirmationIssuedPayloadSchema, INVOICE_PAID_EVENT_QN, PAYMENT_RECEIVED_EVENT_QN, SUBSCRIPTION_CREATED_EVENT_QN, SUBSCRIPTION_UPDATED_EVENT_QN, } from "../events.js";
@@ -48,7 +47,7 @@ export function registerConsumerProtection(r, options, consumerProtection) {
             // user), never from payload data.
             const tenantId = ctx.systemUser.tenantId;
             const currentPeriodEndIso = payload["currentPeriodEndIso"];
-            const result = await ctx.writeAs(createSystemUser(tenantId), SubscriptionFoundationHandlers.issueContractConfirmation, {
+            const result = await ctx.write(SubscriptionFoundationHandlers.issueContractConfirmation, {
                 consentId,
                 sourceAggregateId: isSubscriptionEvent
                     ? subscriptionAggregateId(tenantId)

package/dist/billing-foundation/consumer-protection/register-termination.d.ts

@@ -1,3 +1,3 @@
-import { type FeatureRegistrar } from "@cosmicdrift/kumiko-framework/engine";
+import type { FeatureRegistrar } from "@cosmicdrift/kumiko-framework/engine";
 import type { ConsumerProtectionOptions, ResolvedBillingFoundationOptions } from "../types.js";
 export declare function registerContractTermination(r: FeatureRegistrar, options: ResolvedBillingFoundationOptions, consumerProtection: ConsumerProtectionOptions): void;

package/dist/billing-foundation/consumer-protection/register-termination.js

@@ -1,4 +1,3 @@
-import { createSystemUser } from "@cosmicdrift/kumiko-framework/engine";
 import { SubscriptionCancelTimings, SubscriptionFoundationHandlers } from "../constants.js";
 import { CONTRACT_TERMINATION_DECLARED_EVENT_QN, CONTRACT_TERMINATION_DECLARED_EVENT_SHORT, CONTRACT_TERMINATION_REQUESTED_EVENT_SHORT, CONTRACT_TERMINATION_UNMATCHED_EVENT_SHORT, contractTerminationDeclaredPayloadSchema, contractTerminationRequestedPayloadSchema, contractTerminationUnmatchedPayloadSchema, } from "../events.js";
 import { createDeclareContractTerminationHandler, createRecordContractTerminationHandler, createRecordUnmatchedContractTerminationHandler, createTerminableSubscriptionQuery, } from "./termination-record.js";
@@ -22,7 +21,7 @@ export function registerContractTermination(r, options, consumerProtection) {
         // skip: trigger event carries no usable declaration
         if (!declared.success)
             return;
-        const result = await ctx.writeAs(createSystemUser(ctx.systemUser.tenantId), SubscriptionFoundationHandlers.recordContractTermination, {
+        const result = await ctx.write(SubscriptionFoundationHandlers.recordContractTermination, {
             requestId: declared.data.requestId,
             declarationType: declared.data.declarationType,
             terminationKind: declared.data.terminationKind,

package/dist/cap-overview/handlers/caps-usage.query.js

@@ -1,7 +1,7 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
-import { crossTenantOverrideDenied, defineQueryHandler, } from "@cosmicdrift/kumiko-framework/engine";
-import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import { defineQueryHandler, mayOverrideTenant, } from "@cosmicdrift/kumiko-framework/engine";
+import { AccessDeniedError, FrameworkReasons, InternalError, } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { tierAssignmentEntity } from "../../tier-engine/index.js";
 import { computeFraction, computeTone, computeUnclampedFraction } from "../usage-math.js";
@@ -24,9 +24,12 @@ export function createCapsUsageQuery(caps, usageRoles) {
                 });
             }
             const override = query.payload.tenantId;
-            const overrideDenied = crossTenantOverrideDenied(query.user, override, "cap-overview.errors.tenantOverrideRequiresSystemAdmin");
-            if (overrideDenied)
-                throw overrideDenied;
+            if (override !== undefined && !mayOverrideTenant(query.user)) {
+                throw new AccessDeniedError({
+                    i18nKey: "cap-overview.errors.tenantOverrideRequiresSystemAdmin",
+                    details: { reason: FrameworkReasons.tenantOverrideRequiresSystemAdmin },
+                });
+            }
             const targetTenantId = override ?? query.user.tenantId;
             // Both branches return the SAME unfiltered system-mode db —
             // assertTenantMatch is a self-check on the caller, not a query

package/dist/compliance-profiles/handlers/set-profile.write.js

@@ -1,7 +1,7 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { complianceProfileOverrideSchema, SELECTABLE_PROFILE_KEYS, } from "@cosmicdrift/kumiko-framework/compliance";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
-import { access, crossTenantOverrideDenied, defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
+import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, validationErrorFromZod, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { tenantComplianceProfileEntity, tenantComplianceProfileTable, } from "../schema/profile-selection.js";
@@ -44,9 +44,6 @@ export const setProfileWrite = defineWriteHandler({
     description: "Sets or replaces a tenant's compliance profile key plus an optional JSON override, for onboarding or a later region change; a system admin may target a different tenant through tenantIdOverride.",
     handler: async (event, ctx) => {
         const tenantOverride = event.payload.tenantIdOverride;
-        const overrideDenied = crossTenantOverrideDenied(event.user, tenantOverride, "complianceProfiles.errors.tenantOverrideRequiresSystemAdmin");
-        if (overrideDenied)
-            return writeFailure(overrideDenied);
         const tenantId = (tenantOverride ?? event.user.tenantId); // @cast-boundary engine-payload
         const executorUser = tenantOverride !== undefined ? { ...event.user, tenantId } : event.user;
         // Override-Validation: muss parseables JSON-Object sein UND dem

package/dist/delivery/delivery-service.js

@@ -92,7 +92,7 @@ export function createDeliveryService(options) {
             tenantId,
             actor: systemUser.id,
             sink: escapeHatchAuditSink,
-            log,
+            log: logError,
         });
         // ctx.db/dbOutsideTransaction are tenant-filtered even for a systemScope handler:
         // the dispatcher closes them off entirely there, so "system" mode would hand this

package/dist/managed-pages/handlers/by-tenant-published.query.js

@@ -1,6 +1,6 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { castTenantRows } from "@cosmicdrift/kumiko-framework/db";
-import { crossTenantOverrideDenied, defineQueryHandler, } from "@cosmicdrift/kumiko-framework/engine";
+import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { pagesTable } from "../table.js";
 export const byTenantPublishedQuery = defineQueryHandler({
@@ -15,9 +15,6 @@ export const byTenantPublishedQuery = defineQueryHandler({
     description: "Lists every published page of a tenant with slug, language, title and last-change time but no body; use it to enumerate the public pages for sitemap.xml or llms.txt, rather than by-slug which fetches one page's content.",
     handler: async (query, ctx) => {
         const override = query.payload.tenantIdOverride;
-        const overrideDenied = crossTenantOverrideDenied(query.user, override, "managedPages.errors.tenantOverrideRequiresSystemAdmin");
-        if (overrideDenied)
-            throw overrideDenied;
         const tenantId = override ?? query.user.tenantId;
         const rows = castTenantRows(await selectMany(ctx.db, pagesTable, { tenantId: tenantId, published: true }));
         return {

package/dist/managed-pages/handlers/set.write.js

@@ -1,7 +1,6 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
-import { crossTenantOverrideDenied, defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
-import { writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { pageEntity, pagesTable } from "../table.js";
 const slugSchema = z
@@ -44,9 +43,6 @@ export const setWrite = defineWriteHandler({
     handler: async (event, ctx) => {
         const db = ctx.db;
         const override = event.payload.tenantIdOverride;
-        const overrideDenied = crossTenantOverrideDenied(event.user, override, "managedPages.errors.tenantOverrideRequiresSystemAdmin");
-        if (overrideDenied)
-            return writeFailure(overrideDenied);
         const tenantId = override ?? event.user.tenantId;
         // override: point the executor context at the target tenant, else getStreamVersion runs against user.tenantId → version_conflict.
         const executorUser = override !== undefined ? { ...event.user, tenantId: override } : event.user; // @cast-boundary engine-bridge

package/dist/template-resolver/handlers/by-slug.query.js

@@ -1,5 +1,5 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { crossTenantOverrideDenied, defineQueryHandler, } from "@cosmicdrift/kumiko-framework/engine";
+import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { TEXT_BLOCK_KIND } from "../constants.js";
 import { templateResourcesTable } from "../table.js";
@@ -28,9 +28,6 @@ export const bySlugQuery = defineQueryHandler({
     description: "Reads one text-block of a tenant by slug and locale together with its body and format; it is pinned to the text-block kind so mail templates and AI prompts in the same table stay unreachable through this anonymous-capable path.",
     handler: async (query, ctx) => {
         const override = query.payload.tenantIdOverride;
-        const overrideDenied = crossTenantOverrideDenied(query.user, override, "templateResolver.errors.tenantOverrideRequiresSystemAdmin");
-        if (overrideDenied)
-            throw overrideDenied;
         const tenantId = override ?? query.user.tenantId;
         const row = await fetchOne(ctx.db, templateResourcesTable, {
             tenantId,

package/dist/template-resolver/handlers/by-tenant.query.js

@@ -1,6 +1,6 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { castTenantRows } from "@cosmicdrift/kumiko-framework/db";
-import { crossTenantOverrideDenied, defineQueryHandler, } from "@cosmicdrift/kumiko-framework/engine";
+import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { TEXT_BLOCK_KIND } from "../constants.js";
 import { templateResourcesTable } from "../table.js";
@@ -15,9 +15,6 @@ export const byTenantQuery = defineQueryHandler({
     description: "Lists every text-block of a tenant with slug, locale, title and body so a public content tree can be rendered in one call; use it for the whole sidebar, and by-slug when only one block is needed.",
     handler: async (query, ctx) => {
         const override = query.payload.tenantIdOverride;
-        const overrideDenied = crossTenantOverrideDenied(query.user, override, "templateResolver.errors.tenantOverrideRequiresSystemAdmin");
-        if (overrideDenied)
-            throw overrideDenied;
         const tenantId = override ?? query.user.tenantId;
         const rows = castTenantRows(await selectMany(ctx.db, templateResourcesTable, { tenantId, kind: TEXT_BLOCK_KIND }));
         return {

package/dist/template-resolver/handlers/collection-item.query.js

@@ -1,5 +1,5 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { crossTenantOverrideDenied, defineQueryHandler, } from "@cosmicdrift/kumiko-framework/engine";
+import { defineQueryHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { collectionStore, DEFAULT_COLLECTION_ACCESS, toCollectionEntry, } from "./collection-shared.js";
 // Single entry of one collection, for the editor behind a tree node. Same
@@ -20,9 +20,6 @@ export function makeCollectionItemQuery(collection) {
             : `Reads one tenant-wide "${collection.id}" entry by slug and locale, returning null when it does not exist; use it to open a single entry in the editor rather than to list the collection.`,
         handler: async (query, ctx) => {
             const override = query.payload.tenantIdOverride;
-            const overrideDenied = crossTenantOverrideDenied(query.user, override, "templateResolver.errors.tenantOverrideRequiresSystemAdmin");
-            if (overrideDenied)
-                throw overrideDenied;
             const tenantId = override ?? query.user.tenantId;
             const row = await fetchOne(ctx.db, store.table, {
                 tenantId,

package/dist/template-resolver/handlers/collection-list.query.js

@@ -1,6 +1,6 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { castTenantRows } from "@cosmicdrift/kumiko-framework/db";
-import { crossTenantOverrideDenied, defineQueryHandler, } from "@cosmicdrift/kumiko-framework/engine";
+import { defineQueryHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { collectionStore, DEFAULT_COLLECTION_ACCESS, toCollectionEntry, } from "./collection-shared.js";
 // One list handler per declared collection: `kind`, `ownership` and `access`
@@ -25,9 +25,6 @@ export function makeCollectionListQuery(collection) {
             : `Lists the tenant-wide entries of the "${collection.id}" content collection (${collection.kind} content) with slug, locale, title and body; every caller who may reach this collection sees the same shared set.`,
         handler: async (query, ctx) => {
             const override = query.payload.tenantIdOverride;
-            const overrideDenied = crossTenantOverrideDenied(query.user, override, "templateResolver.errors.tenantOverrideRequiresSystemAdmin");
-            if (overrideDenied)
-                throw overrideDenied;
             const tenantId = override ?? query.user.tenantId;
             const rows = castTenantRows(await selectMany(ctx.db, store.table, {
                 tenantId,

package/dist/template-resolver/handlers/collection-set.write.js

@@ -1,6 +1,5 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { crossTenantOverrideDenied, defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
-import { writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { collectionStore, DEFAULT_COLLECTION_ACCESS, } from "./collection-shared.js";
 import { contentFormatSchema, folderSchema, localeSchema, slugSchema } from "./shared.js";
@@ -32,9 +31,6 @@ export function makeCollectionSetWrite(collection) {
         handler: async (event, ctx) => {
             const db = ctx.db;
             const override = event.payload.tenantIdOverride;
-            const overrideDenied = crossTenantOverrideDenied(event.user, override, "templateResolver.errors.tenantOverrideRequiresSystemAdmin");
-            if (overrideDenied)
-                return writeFailure(overrideDenied);
             // @cast-boundary engine-payload — override is a zod-validated string, the
             // user's own tenantId is already TenantId-branded.
             const tenantId = (override ?? event.user.tenantId);

package/dist/template-resolver/handlers/set.write.js

@@ -1,6 +1,5 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { crossTenantOverrideDenied, defineWriteHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
-import { writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { defineWriteHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { TEMPLATE_KINDS, TEXT_BLOCK_KIND } from "../constants.js";
 import { templateResourcesTable } from "../table.js";
@@ -45,9 +44,6 @@ export const setWrite = defineWriteHandler({
     handler: async (event, ctx) => {
         const db = ctx.db;
         const override = event.payload.tenantIdOverride;
-        const overrideDenied = crossTenantOverrideDenied(event.user, override, "templateResolver.errors.tenantOverrideRequiresSystemAdmin");
-        if (overrideDenied)
-            return writeFailure(overrideDenied);
         // @cast-boundary engine-payload — override is a zod-validated string, the
         // user's own tenantId is already TenantId-branded.
         const tenantId = (override ?? event.user.tenantId);

package/dist/template-resolver/handlers/upsert-tenant.write.js

@@ -1,5 +1,5 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { crossTenantOverrideDenied, defineWriteHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { defineWriteHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { templateResourcesTable } from "../table.js";
@@ -20,9 +20,6 @@ export const upsertTenantWrite = defineWriteHandler({
     handler: async (event, ctx) => {
         const db = ctx.db;
         const override = event.payload.tenantIdOverride;
-        const overrideDenied = crossTenantOverrideDenied(event.user, override, "templateResolver.errors.tenantOverrideRequiresSystemAdmin");
-        if (overrideDenied)
-            return writeFailure(overrideDenied);
         // upsertTenant erzeugt scope='tenant'. SYSTEM_TENANT_ID-Override würde
         // scope='tenant' unter SYSTEM_TENANT_ID schreiben → inkonsistenter Zustand
         // (Resolver-Logik trennt sauber zwischen system+tenant). SystemAdmin muss

package/dist/template-resolver/seeding.js

@@ -29,8 +29,7 @@ async function resolveExistingForEventStoreSeed(db, tdb, existingRow, tenantId)
         if (unscoped !== 0) {
             throw new Error(`seed orphan check: projection ${id} has no events for tenant ${tenantId} but unscoped stream version is ${unscoped} — refusing delete/recreate to avoid wiping a live stream`);
         }
-        // @cast-boundary orphan projection cleanup: empty stream, no executor verb;
-        // plain table ident trips guard-direct-entity-writes (infra EXCLUDE follow-up).
+        // The cast strips the executor-only brand that WritableTable rejects; the orphan row has no events, so no executor verb applies.
         await deleteMany(tdb, templateResourcesTable, { id, tenantId });
         return null;
     }

package/dist/tenant-lifecycle/feature.js

@@ -89,6 +89,7 @@ export function createTenantLifecycleFeature() {
                     fileProviderResolver: ctx._fileProviderResolver,
                     searchAdapter: ctx.searchAdapter,
                     escapeHatchAuditSink: ctx._escapeHatchAuditSink,
+                    escapeHatchAuditLog: ctx.log,
                     actor: ctx.systemUser.id,
                 });
             },

package/dist/tenant-lifecycle/run-tenant-destroy.d.ts

@@ -2,6 +2,7 @@
 import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { type EscapeHatchAuditSink, type Registry, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { FileProviderResolver } from "@cosmicdrift/kumiko-framework/files";
+import type { Logger } from "@cosmicdrift/kumiko-framework/logging";
 import type { SearchAdapter } from "@cosmicdrift/kumiko-framework/search";
 type StageTickResult = {
     readonly done: boolean;
@@ -17,6 +18,7 @@ export declare function runNextDestructionStage(args: {
     readonly fileProviderResolver?: FileProviderResolver;
     readonly searchAdapter?: SearchAdapter;
     readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
+    readonly escapeHatchAuditLog?: Logger;
     readonly actor?: string;
 }): Promise<StageTickResult>;
 export declare function hasTenantDestructionWork(reads: Pick<TenantDb, "count">, now: Temporal.Instant): Promise<boolean>;
@@ -29,6 +31,7 @@ export declare function runTenantDestructionSweep(args: {
     readonly fileProviderResolver?: FileProviderResolver;
     readonly searchAdapter?: SearchAdapter;
     readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
+    readonly escapeHatchAuditLog?: Logger;
     readonly actor?: string;
 }): Promise<{
     readonly triggered: number;

package/dist/tenant-lifecycle/run-tenant-destroy.js

@@ -162,6 +162,7 @@ export async function runNextDestructionStage(args) {
         fileProviderResolver: args.fileProviderResolver,
         searchAdapter: args.searchAdapter,
         escapeHatchAuditSink: args.escapeHatchAuditSink,
+        escapeHatchAuditLog: args.escapeHatchAuditLog,
         actor: args.actor,
         deadlineAt: Date.now() + DESTRUCTION_STAGE_TICK_BUDGET_MS,
     };
@@ -258,6 +259,7 @@ export async function runTenantDestructionSweep(args) {
                 fileProviderResolver: args.fileProviderResolver,
                 searchAdapter: args.searchAdapter,
                 escapeHatchAuditSink: args.escapeHatchAuditSink,
+                escapeHatchAuditLog: args.escapeHatchAuditLog,
                 actor: args.actor,
             });
             if (!result.error && !result.halted)

package/dist/tenant-lifecycle/stages.d.ts

@@ -1,6 +1,7 @@
 import { type DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import { type EscapeHatchAuditSink, type Registry, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { FileProviderResolver } from "@cosmicdrift/kumiko-framework/files";
+import { type Logger } from "@cosmicdrift/kumiko-framework/logging";
 import { type SearchAdapter } from "@cosmicdrift/kumiko-framework/search";
 import type { TenantDestructionStageName } from "./constants.js";
 export type DestructionStageCtx = {
@@ -11,6 +12,7 @@ export type DestructionStageCtx = {
     readonly fileProviderResolver?: FileProviderResolver;
     readonly searchAdapter?: SearchAdapter;
     readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
+    readonly escapeHatchAuditLog?: Logger;
     readonly actor?: string;
     readonly deadlineAt: number;
 };

package/dist/tenant-lifecycle/stages.js

@@ -2,6 +2,7 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
 import { createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, EXT_EXTERNAL_RESOURCE, EXT_INFRA_RESOURCE, EXT_SEARCH_ADAPTER, EXT_STORAGE_PROVIDER, EXT_TENANT_DATA, extensionUsageEscapeHatchReason, isTenantDataExtensionHooks, isTenantResourceExtensionHooks, } from "@cosmicdrift/kumiko-framework/engine";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { createEscapeHatchReporter, UNATTRIBUTED_ACTOR, } from "@cosmicdrift/kumiko-framework/pipeline";
 import { purgeSearchDocumentsForSubject, } from "@cosmicdrift/kumiko-framework/search";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
@@ -51,6 +52,7 @@ async function runTenantDataHooks(ctx) {
             tenantId: ctx.tenantId,
             actor: ctx.actor ?? UNATTRIBUTED_ACTOR,
             sink: ctx.escapeHatchAuditSink,
+            log: ctx.escapeHatchAuditLog ?? createFallbackLogger("tenant-lifecycle"),
         });
         const hookCtx = {
             db: createTenantDb(ctx.db, ctx.tenantId, "tenant", undefined, undefined, undefined, {

package/dist/user-data-rights/feature.js

@@ -477,6 +477,7 @@ export function createUserDataRightsFeature(opts = {}) {
                         appExportDownloadUrl: opts.appExportDownloadUrl,
                     }),
                     escapeHatchAuditSink: ctx._escapeHatchAuditSink,
+                    escapeHatchAuditLog: ctx.log,
                     actor: ctx.systemUser.id,
                     metrics: exportMetrics,
                 });
@@ -541,6 +542,7 @@ export function createUserDataRightsFeature(opts = {}) {
                     }),
                     ...(sendDeletionExecutedEmail && { sendDeletionExecutedEmail }),
                     escapeHatchAuditSink: ctx._escapeHatchAuditSink,
+                    escapeHatchAuditLog: ctx.log,
                     actor: ctx.systemUser.id,
                 });
                 // Persist each incomplete report on the job-run log (#1572). The write

package/dist/user-data-rights/run-export-jobs.d.ts

@@ -1,3 +1,4 @@
+import type { Logger } from "@cosmicdrift/kumiko-framework/logging";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { EscapeHatchAuditSink, Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { type FileStorageProvider } from "@cosmicdrift/kumiko-framework/files";
@@ -75,6 +76,7 @@ export interface RunExportJobsArgs {
      *  Callback durch. Required wenn sendExportReadyEmail gesetzt. */
     readonly appExportDownloadUrl?: string;
     readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
+    readonly escapeHatchAuditLog?: Logger;
     readonly actor?: string;
     /**
      * Reports EXPORT_CLEANUP_BACKLOG_AGE_METRIC after the storage-cleanup

package/dist/user-data-rights/run-export-jobs.js

@@ -106,6 +106,7 @@ export async function runExportJobs(args) {
             now,
             job,
             escapeHatchAuditSink: args.escapeHatchAuditSink,
+            escapeHatchAuditLog: args.escapeHatchAuditLog,
             actor: args.actor,
         });
         if (outcome.kind === "done") {
@@ -230,6 +231,7 @@ async function processJob(args) {
             userId: job.userId,
             now,
             escapeHatchAuditSink: args.escapeHatchAuditSink,
+            escapeHatchAuditLog: args.escapeHatchAuditLog,
             actor: args.actor,
         });
         const profile = await resolveProfileForTenant({

package/dist/user-data-rights/run-forget-cleanup.d.ts

@@ -1,3 +1,4 @@
+import { type Logger } from "@cosmicdrift/kumiko-framework/logging";
 import { type KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
 import { type DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import { type EscapeHatchAuditSink, type Registry, type TenantId, type TenantUserModel, type UserDataDeleteStrategy, type UserDataStorageProvider } from "@cosmicdrift/kumiko-framework/engine";
@@ -69,6 +70,7 @@ export interface RunForgetCleanupArgs {
      */
     readonly tenantModel?: TenantUserModel;
     readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
+    readonly escapeHatchAuditLog?: Logger;
     readonly actor?: string;
 }
 export interface ForgetCleanupError {

package/dist/user-data-rights/run-forget-cleanup.js

@@ -1,3 +1,4 @@
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 // Forget-Cleanup-Runner (S2.U5b) — pure-Function Pipeline.
 //
 // After the grace period (S2.U5a sets gracePeriodEnd) this runner iterates
@@ -51,6 +52,7 @@ function buildHookDb(db, tenantId, entry, args) {
         tenantId,
         actor: args.actor ?? UNATTRIBUTED_ACTOR,
         sink: args.escapeHatchAuditSink,
+        log: args.escapeHatchAuditLog ?? createFallbackLogger("user-data-rights"),
     });
     return createTenantDb(db, tenantId, "tenant", undefined, undefined, undefined, {
         unsafeRaw: entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
@@ -117,6 +119,7 @@ export async function runForgetCleanup(args) {
             kms,
             searchAdapter: args.searchAdapter,
             escapeHatchAuditSink: args.escapeHatchAuditSink,
+            escapeHatchAuditLog: args.escapeHatchAuditLog,
             actor: args.actor,
         });
         hookCallsAttempted += userResult.hookCallsAttempted;
@@ -235,6 +238,7 @@ async function processUser(args) {
                     const hookResult = await entry.deleteHook({
                         db: buildHookDb(tx, tenantId, entry, {
                             escapeHatchAuditSink: args.escapeHatchAuditSink,
+                            escapeHatchAuditLog: args.escapeHatchAuditLog,
                             actor: args.actor,
                         }),
                         registry,

package/dist/user-data-rights/run-user-export.d.ts

@@ -1,3 +1,4 @@
+import { type Logger } from "@cosmicdrift/kumiko-framework/logging";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import { type EscapeHatchAuditSink, type Registry, type TenantId, type UserDataExportSnippet } from "@cosmicdrift/kumiko-framework/engine";
 import type { getTemporal } from "@cosmicdrift/kumiko-framework/time";
@@ -8,6 +9,7 @@ export interface RunUserExportArgs {
     readonly userId: string;
     readonly now: Instant;
     readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
+    readonly escapeHatchAuditLog?: Logger;
     readonly actor?: string;
 }
 export interface UserExportFileRef {

package/dist/user-data-rights/run-user-export.js

@@ -1,3 +1,4 @@
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 // User-Data-Export-Pipeline (S2.U3) — DSGVO Art. 15 (Auskunft) +
 // Art. 20 (Datenportabilität).
 //
@@ -32,6 +33,7 @@ function buildHookDb(db, tenantId, entry, args) {
         tenantId,
         actor: args.actor ?? UNATTRIBUTED_ACTOR,
         sink: args.escapeHatchAuditSink,
+        log: args.escapeHatchAuditLog ?? createFallbackLogger("user-data-rights"),
     });
     return createTenantDb(db, tenantId, "tenant", undefined, undefined, undefined, {
         unsafeRaw: entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.354.0",
+  "version": "0.355.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -516,12 +516,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.354.0",
-    "@cosmicdrift/kumiko-framework": "0.354.0",
-    "@cosmicdrift/kumiko-headless": "0.354.0",
-    "@cosmicdrift/kumiko-renderer": "0.354.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.354.0",
-    "@cosmicdrift/kumiko-types": "0.354.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.355.0",
+    "@cosmicdrift/kumiko-framework": "0.355.0",
+    "@cosmicdrift/kumiko-headless": "0.355.0",
+    "@cosmicdrift/kumiko-renderer": "0.355.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.355.0",
+    "@cosmicdrift/kumiko-types": "0.355.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -1050,8 +1050,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.354.0",
-    "@cosmicdrift/kumiko-locale-es": "0.354.0",
+    "@cosmicdrift/kumiko-locale-de": "0.355.0",
+    "@cosmicdrift/kumiko-locale-es": "0.355.0",
     "jsqr": "^1.4.0"
   }
 }