@cosmicdrift/kumiko-bundled-features 0.362.0 → 0.363.0

package/dist/delivery/jobs.js

@@ -6,6 +6,8 @@
 // these handlers append the terminal sent/failed event on the same stream.
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { fileContextForTenant } from "../file-foundation/index.js";
+import { emailAttachmentRefSchema, MAX_EMAIL_ATTACHMENTS, toAttachmentRef, } from "./attachment-ref.js";
 import { appendAttemptEvent } from "./attempt-log.js";
 import { buildChannelContext } from "./channel-context.js";
 import { DeliveryJobs, deliveryIdempotencyRedisKey, deliveryPriorityRank } from "./constants.js";
@@ -30,7 +32,12 @@ const renderJobPayloadSchema = z.object({
 });
 const sendJobPayloadSchema = renderJobPayloadSchema.extend({
     rendered: z
-        .object({ html: z.string(), subject: z.string(), text: z.string().optional() })
+        .object({
+        html: z.string(),
+        subject: z.string(),
+        text: z.string().optional(),
+        attachments: z.array(emailAttachmentRefSchema).max(MAX_EMAIL_ATTACHMENTS).optional(),
+    })
         .optional(),
 });
 function requireTenantScopedDeps(ctx, tenantId) {
@@ -39,15 +46,28 @@ function requireTenantScopedDeps(ctx, tenantId) {
         throw new Error("delivery job: missing registry in job context");
     // delivery is r.systemScope()'d, so JobContext.systemDb is guaranteed; unsafeRaw
     // hands the underlying DbConnection to both — safe since they filter by tenantId themselves.
+    // Attachment lookups read only this tenant's FileRefs, plus the system tenant's for inline images.
     if (!ctx.systemDb) {
         throw new InternalError({
             message: "delivery job: ctx.systemDb missing on a system-scoped job",
         });
     }
+    // Also makes ctx.config (built for the job's tenant) the accessor of the payload tenant;
+    // job contexts carry no configFor.
     ctx.systemDb.assertTenantMatch(tenantId);
-    const db = ctx.systemDb.unsafeRaw("delivery attempt append and channel context filter by this job's tenantId themselves"); // @cast-boundary db-operator — DbRunner narrows to DbConnection, jobs never run inside a DbTx
+    const db = ctx.systemDb.unsafeRaw("attempt append and channel context filter by this job's tenantId; attachment lookup reads only the job tenant's FileRefs plus, for inline images, the system tenant's"); // @cast-boundary db-operator — DbRunner narrows to DbConnection, jobs never run inside a DbTx
     return { db, registry };
 }
+function toSendRendered(rendered) {
+    return {
+        html: rendered.html,
+        subject: rendered.subject,
+        ...(rendered.text !== undefined && { text: rendered.text }),
+        ...(rendered.attachments !== undefined && {
+            attachments: rendered.attachments.map(toAttachmentRef),
+        }),
+    };
+}
 function resolveChannel(registry, name) {
     const channel = collectChannels(registry).find((c) => c.name === name);
     if (!channel)
@@ -119,7 +139,7 @@ export const deliveryRenderJob = async (payload, ctx) => {
     const tenantId = p.tenantId; // @cast-boundary engine-payload — stream tenant
     const { db, registry } = requireTenantScopedDeps(ctx, tenantId);
     const channel = resolveChannel(registry, p.channelName);
-    const channelCtx = buildChannelContext(db, registry, undefined, tenantId, ctx.secrets);
+    const channelCtx = buildChannelContext(db, registry, undefined, tenantId, ctx.secrets, ctx.config, (fileTenantId) => fileContextForTenant(ctx, fileTenantId));
     let rendered;
     try {
         if (!channel.render) {
@@ -132,7 +152,7 @@ export const deliveryRenderJob = async (payload, ctx) => {
     }
     try {
         const jobRunner = ctx["jobRunner"]; // @cast-boundary dynamic-key — dispatch lives on the concrete runner
-        await jobRunner.dispatch(DeliveryJobs.send, { ...p, rendered }, { priority: deliveryPriorityRank[p.priority] });
+        await jobRunner.dispatch(DeliveryJobs.send, { ...p, rendered: toSendRendered(rendered) }, { priority: deliveryPriorityRank[p.priority] });
     }
     catch (err) {
         return failAttempt(ctx, db, registry, p, "channel_error", err);
@@ -146,7 +166,7 @@ export const deliverySendJob = async (payload, ctx) => {
     const tenantId = p.tenantId; // @cast-boundary engine-payload — stream tenant
     const { db, registry } = requireTenantScopedDeps(ctx, tenantId);
     const channel = resolveChannel(registry, p.channelName);
-    const channelCtx = buildChannelContext(db, registry, undefined, tenantId, ctx.secrets);
+    const channelCtx = buildChannelContext(db, registry, undefined, tenantId, ctx.secrets, ctx.config, (fileTenantId) => fileContextForTenant(ctx, fileTenantId));
     try {
         const result = await channel.send(p.address, toMessage(p), channelCtx, p.rendered);
         await appendAttemptEvent(db, registry, p.deliveryAttemptId, entryFor(p, result.status, result.error ?? null, result.address ?? p.address, result.confirmed));

package/dist/delivery/notify-factory.js

@@ -2,5 +2,8 @@
 // job dispatcher is handed to notify() per call, so queued channels go through
 // the delivery jobs. deliverQueuedInline drops the dispatcher and sends inline.
 export function createDeliveryNotifyFactory(deliveryService, options = {}) {
-    return (user, tenantId, jobDispatcher) => (notificationType, notifyOptions) => deliveryService.notify(notificationType, notifyOptions, user, tenantId, options.deliverQueuedInline === true ? undefined : jobDispatcher);
+    return (user, tenantId, jobDispatcher, deliveryDb, fileProviderResolver) => {
+        const notify = (notificationType, notifyOptions) => deliveryService.notify(notificationType, notifyOptions, user, tenantId, options.deliverQueuedInline === true ? undefined : jobDispatcher, deliveryDb, fileProviderResolver);
+        return notify;
+    };
 }

package/dist/delivery/testing.d.ts

@@ -1,6 +1,7 @@
 import type { SseBroker } from "@cosmicdrift/kumiko-framework/api";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import type { EscapeHatchAuditSink, Registry } from "@cosmicdrift/kumiko-framework/engine";
+import type { ConfigAccessor, EscapeHatchAuditSink, Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { FileContext } from "@cosmicdrift/kumiko-framework/files";
 import type { JobRunner } from "@cosmicdrift/kumiko-framework/jobs";
 import type { Logger } from "@cosmicdrift/kumiko-framework/logging";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
@@ -16,6 +17,8 @@ export type CreateDeliveryTestContextOptions = {
     readonly jobRunner?: JobRunner;
     readonly secrets?: SecretsContext;
     readonly idempotencyRedis?: Redis;
+    readonly filesForTenant?: (tenantId: string) => FileContext | undefined;
+    readonly tenantConfigFor?: (tenantId: TenantId) => ConfigAccessor;
 };
 /**
  * Helper for setupTestStack: creates a DeliveryService + _notifyFactory for the test context.

package/dist/delivery/types.d.ts

@@ -1,15 +1,31 @@
 import type { SseBroker } from "@cosmicdrift/kumiko-framework/api";
-import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
-import type { DeliveryErrorCode, NotifyDeliveryStatus, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, Registry, SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { DbConnection, TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import type { DeliveryErrorCode, NotifyDeliveryStatus, NotifyDispatched, NotifyJobDispatcher, NotifyOptions, NotifyPriority, Registry, SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { FileProviderResolver } from "@cosmicdrift/kumiko-framework/files";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
+import type { MailPayload } from "../renderer-foundation/index.js";
+import type { EmailAttachmentRef } from "./attachment-ref.js";
 import { DELIVERY_CHANNEL_EXTENSION } from "./constants.js";
+export type RenderedMail = {
+    readonly subject: string;
+    readonly html: string;
+    readonly text: string;
+    readonly previewText?: string;
+    readonly attachments?: readonly EmailAttachmentRef[];
+};
 export type ChannelContext = {
     readonly db: TenantDb;
     readonly registry: Registry;
     readonly sseBroker: SseBroker | undefined;
     readonly tenantId: TenantId;
     readonly secrets?: SecretsContext | undefined;
+    readonly renderMail?: (payload: MailPayload) => Promise<RenderedMail>;
+    readonly readAttachment?: (ref: EmailAttachmentRef, origin?: AttachmentOrigin) => Promise<{
+        readonly content: Uint8Array;
+        readonly contentType: string;
+    } | null>;
 };
+export type AttachmentOrigin = "template" | "message";
 export type ChannelMessage = {
     readonly notificationType: string;
     readonly title: string;
@@ -27,6 +43,7 @@ export type RenderedMessage = {
     readonly html: string;
     readonly subject: string;
     readonly text?: string;
+    readonly attachments?: readonly EmailAttachmentRef[];
 };
 export declare const DELIVERY_CHANNEL_MODES: readonly ["inline", "queued"];
 export type DeliveryChannelMode = (typeof DELIVERY_CHANNEL_MODES)[number];
@@ -38,17 +55,6 @@ export type DeliveryChannel = {
     render?(message: ChannelMessage, ctx: ChannelContext): Promise<RenderedMessage>;
     send(address: string, message: ChannelMessage, ctx: ChannelContext, rendered?: RenderedMessage): Promise<ChannelResult>;
 };
-export type RendererInput = {
-    readonly template: string;
-    readonly variables: Readonly<Record<string, unknown>>;
-    readonly locale?: string | undefined;
-};
-export type NotificationRenderer = {
-    readonly name: string;
-    render(input: RendererInput): Promise<string>;
-    /** Plain-text version of the same mail; the email channel sends it as the text part of a multipart/alternative mail. */
-    renderText?(input: RendererInput): Promise<string>;
-};
 export type DeliveryLogEntry = {
     readonly tenantId: TenantId;
     readonly notificationType: string;
@@ -61,7 +67,7 @@ export type DeliveryLogEntry = {
     readonly confirmed?: false;
 };
 export type DeliveryService = {
-    notify(notificationType: string, options: NotifyOptions, user: SessionUser, tenantId: TenantId, jobDispatcher?: NotifyJobDispatcher): Promise<NotifyResult>;
+    notify(notificationType: string, options: NotifyOptions, user: SessionUser, tenantId: TenantId, jobDispatcher?: NotifyJobDispatcher, deliveryDb?: DbConnection, fileProviderResolver?: FileProviderResolver): Promise<NotifyDispatched>;
 };
 export type DeliveryChannelPlugin = Omit<DeliveryChannel, "name">;
 export declare function isDeliveryChannelPlugin(o: unknown): o is DeliveryChannelPlugin;

package/dist/delivery/unsubscribe.js

@@ -1,5 +1,6 @@
 import { ExtraRouteRejection, signatureRoute, } from "@cosmicdrift/kumiko-framework/api";
 import { escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import * as jose from "jose";
 import * as z from "zod";
 import { hashUnsubscribeAddress } from "./address-opt-out.js";
@@ -280,7 +281,9 @@ function tokenFromRequestBody(request) {
     if (contentType?.includes("application/json")) {
         try {
             const parsed = JSON.parse(request.rawBody);
-            return typeof parsed.token === "string" ? parsed.token : undefined;
+            return isPlainObject(parsed) && typeof parsed["token"] === "string"
+                ? parsed["token"]
+                : undefined;
         }
         catch {
             return undefined;

package/dist/derivatives-sharp/render.js

@@ -3,12 +3,9 @@
 // region blur (see BlurRegion). Server-only: sharp is a native binding.
 import QRCode from "qrcode";
 import sharp from "sharp";
+import { assertNotSvg, SHARP_INPUT_OPTIONS } from "../shared/index.js";
 const MIN_SHARP_SIGMA = 0.3;
 const MAX_SHARP_SIGMA = 1000;
-// Above this, a decoded pixel buffer runs into hundreds of MB before any
-// resize even happens — sharp's own default (~268MP) is still large enough
-// to be an OOM primitive for a single request.
-const MAX_INPUT_PIXELS = 100_000_000;
 // Longest output edge a caller may request via `size`/`maxEdge`. Without a
 // cap, `{ maxEdge: 50000 }` allocates a multi-gigabyte buffer per encoder
 // step before any client sees a byte back.
@@ -27,26 +24,12 @@ const MAX_QR_DATA_LENGTH = 1024;
 // camera capture — the AC claims phone-scannable, so an under-sized layer
 // throws instead of caching a silently unusable image.
 const MIN_QR_PIXEL_WIDTH = 160;
-// sequentialRead trades random pixel access for lower peak memory on
-// streamed formats — applied at every decode entry point below since none
-// of them need non-sequential access to the *original* bytes (extract runs
-// against a single already-buffered region per call).
-const SHARP_INPUT_OPTIONS = { limitInputPixels: MAX_INPUT_PIXELS, sequentialRead: true };
 function normalizeMimeType(mimeType) {
     return mimeType.toLowerCase().split(";")[0]?.trim() ?? "";
 }
 function clampSigma(sigma) {
     return Math.min(MAX_SHARP_SIGMA, Math.max(MIN_SHARP_SIGMA, sigma));
 }
-// Shared trust boundary for every image byte source this renderer decodes —
-// the original upload (renderImage) and an overlay layer's bytes (applyOverlays)
-// alike: a base64 string in a field declaration isn't more trustworthy than
-// an upload just because it came from app code.
-function assertNotSvg(format) {
-    if (format === "svg") {
-        throw new Error("derivatives-sharp: SVG is not supported — rendering untrusted SVG through libvips is a trust boundary this renderer doesn't need to cross.");
-    }
-}
 function assertValidRegion(region) {
     const values = [region.x, region.y, region.width, region.height];
     if (values.some((v) => !Number.isFinite(v)) || region.width <= 0 || region.height <= 0) {

package/dist/document-ingest-foundation/pages.js

@@ -3,6 +3,7 @@
 // JSON.stringify(IngestPage[]) and readers must parse back. Centralising
 // the codec here keeps liteparse + recipe consumers lockstep with the
 // entity shape (kumiko-framework#1549/1).
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 export function writeIngestPages(pages) {
     return JSON.stringify(pages);
 }
@@ -25,8 +26,7 @@ function parseJson(raw) {
     }
 }
 function isIngestPage(value) {
-    if (value === null || typeof value !== "object")
-        return false;
-    const page = value;
-    return typeof page.pageNumber === "number" && typeof page.text === "string";
+    return (isPlainObject(value) &&
+        typeof value["pageNumber"] === "number" &&
+        typeof value["text"] === "string");
 }

package/dist/feature-toggles/toggle-sync-signal.js

@@ -1,12 +1,12 @@
 import { CACHE_SYNC_TOPICS, createRedisPubSubSignal, redisChannelPrefixFromEnv, } from "@cosmicdrift/kumiko-framework/redis";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 // Single fixed channel — unlike the SSE broker there's no per-tenant/
 // per-user variance to multiplex, every toggle flip is global.
 const TOGGLE_SYNC_CHANNEL_NAME = "kumiko:feature-toggles:cache-sync";
 function isTogglePayload(value) {
-    return (typeof value === "object" &&
-        value !== null &&
-        typeof value.featureName === "string" &&
-        typeof value.enabled === "boolean");
+    return (isPlainObject(value) &&
+        typeof value["featureName"] === "string" &&
+        typeof value["enabled"] === "boolean");
 }
 // fw#2625: gives toggle-cache-sync the cross-replica transport its shared
 // dispatcher cursor needs — without this, only the one process that won

package/dist/file-foundation/index.d.ts

@@ -1 +1,2 @@
 export { createFileProviderForTenant, type FileProviderContext, type FileProviderPlugin, fileFoundationFeature, isFileProviderPlugin, } from "./feature.js";
+export { type FileRefContent, FileRefTooLargeError, fileContextForTenant, fileContextFromResolver, readFileRefContent, } from "./read-file-ref-content.js";

package/dist/file-foundation/index.js

@@ -1,2 +1,3 @@
 // Public API of the file-foundation bundled-feature.
 export { createFileProviderForTenant, fileFoundationFeature, isFileProviderPlugin, } from "./feature.js";
+export { FileRefTooLargeError, fileContextForTenant, fileContextFromResolver, readFileRefContent, } from "./read-file-ref-content.js";

package/dist/file-foundation/read-file-ref-content.d.ts

@@ -0,0 +1,27 @@
+import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { type FileContext, type FileProviderResolver } from "@cosmicdrift/kumiko-framework/files";
+export type FileRefContent = {
+    readonly content: Uint8Array;
+    readonly contentType: string;
+    readonly tenantId: string;
+    readonly size: number;
+};
+export declare function fileContextForTenant(ctx: {
+    readonly _fileProviderResolver?: FileProviderResolver | undefined;
+    readonly files?: FileContext | undefined;
+}, tenantId: string): FileContext | undefined;
+export declare function fileContextFromResolver(resolver: FileProviderResolver, tenantId: string): FileContext;
+export declare class FileRefTooLargeError extends Error {
+    readonly size: number;
+    constructor(size: number);
+}
+export declare function readFileRefContent(args: {
+    readonly db: DbRunner | TenantDb;
+    readonly filesForTenant: (tenantId: string) => FileContext | undefined;
+    readonly fileRefId: string;
+    readonly allowedTenantIds: readonly string[];
+    /** Only accept this user's own upload that is not bound to any entity yet. */
+    readonly unclaimedUploadOf?: string;
+    /** Rejects before any bytes are read when the stored size exceeds the limit. */
+    readonly maxBytes?: number;
+}): Promise<FileRefContent | null>;

package/dist/file-foundation/read-file-ref-content.js

@@ -0,0 +1,49 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { isUuid } from "@cosmicdrift/kumiko-framework/engine";
+import { createFileContext, fileRefsTable, } from "@cosmicdrift/kumiko-framework/files";
+// Tenant-bound on purpose: the FileContext of the current request only reaches its own key space.
+export function fileContextForTenant(ctx, tenantId) {
+    const resolver = ctx._fileProviderResolver;
+    if (resolver === undefined)
+        return ctx.files;
+    return fileContextFromResolver(resolver, tenantId);
+}
+export function fileContextFromResolver(resolver, tenantId) {
+    // @cast-boundary engine-payload — tenantId comes from a trusted job payload or session
+    const brandedTenantId = tenantId;
+    return createFileContext(() => resolver(brandedTenantId), tenantId);
+}
+export class FileRefTooLargeError extends Error {
+    size;
+    constructor(size) {
+        super(`file ref exceeds the size limit (${size} bytes)`);
+        this.size = size;
+    }
+}
+// fileName of the row is never used: it is personal data and may be a PII ciphertext.
+export async function readFileRefContent(args) {
+    if (!isUuid(args.fileRefId))
+        return null;
+    const [row] = await selectMany(args.db, fileRefsTable, {
+        id: args.fileRefId,
+        tenantId: { in: args.allowedTenantIds },
+        isDeleted: false,
+        ...(args.unclaimedUploadOf !== undefined && {
+            insertedById: args.unclaimedUploadOf,
+            entityType: null,
+            entityId: null,
+        }),
+    });
+    if (row === undefined)
+        return null;
+    const size = Number(row.size);
+    if (args.maxBytes !== undefined && size > args.maxBytes) {
+        throw new FileRefTooLargeError(size);
+    }
+    const files = args.filesForTenant(row.tenantId);
+    if (files === undefined) {
+        throw new Error("readFileRefContent: no file storage is available for the file's tenant");
+    }
+    const content = await files.ref(row.storageKey).read();
+    return { content, contentType: row.mimeType, tenantId: row.tenantId, size };
+}

package/dist/folders/web/folder-manager.js

@@ -42,7 +42,8 @@ const loadCollapsed = () => {
         return new Set();
     try {
         const raw = window.localStorage.getItem(COLLAPSED_KEY);
-        return new Set(raw ? JSON.parse(raw) : []);
+        const parsed = raw ? JSON.parse(raw) : [];
+        return new Set(Array.isArray(parsed) ? parsed.filter((id) => typeof id === "string") : []);
     }
     catch {
         return new Set();
@@ -207,7 +208,7 @@ export function FolderManager({ renderMeta, filing, }) {
                 setDragOverKey(key);
             },
             onDragLeave: (e) => {
-                if (!e.currentTarget.contains(e.relatedTarget))
+                if (!(e.relatedTarget instanceof Node && e.currentTarget.contains(e.relatedTarget)))
                     setDragOverKey((cur) => (cur === key ? null : cur));
             },
             onDrop: (e) => {

package/dist/form-draft/db/queries/cleanup.js

@@ -12,10 +12,10 @@ import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 // rebuild must not resurrect a "deleted" draft). Ordered oldest-first so a
 // batch is a stable, deterministic slice across the two queries.
 export async function selectStaleDraftsBatch(db, olderThanDays, batchSize) {
-    const rows = (await unsafeReadRetrying(db, `SELECT "id", "tenant_id", "owner_id", "draft_key", "draft", "inserted_at" FROM "read_form_drafts"
+    const rows = await unsafeReadRetrying(db, `SELECT "id", "tenant_id", "owner_id", "draft_key", "draft", "inserted_at" FROM "read_form_drafts"
      WHERE COALESCE("modified_at", "inserted_at") < now() - ($1::int * interval '1 day')
      ORDER BY COALESCE("modified_at", "inserted_at") ASC
-     LIMIT $2`, [olderThanDays, batchSize]));
+     LIMIT $2`, [olderThanDays, batchSize]);
     return rows.map((row) => ({
         id: row.id,
         tenantId: row.tenant_id, // @cast-boundary db-row
@@ -27,10 +27,10 @@ export async function selectStaleDraftsBatch(db, olderThanDays, batchSize) {
 }
 /** Re-check staleness after the select→release window so a freshly saved draft is not deleted. */
 export async function isDraftStillStale(db, tenantId, id, olderThanDays) {
-    const rows = (await unsafeReadRetrying(db, `SELECT 1 FROM "read_form_drafts"
+    const rows = await unsafeReadRetrying(db, `SELECT 1 FROM "read_form_drafts"
      WHERE "id" = $1
        AND "tenant_id" = $2
        AND COALESCE("modified_at", "inserted_at") < now() - ($3::int * interval '1 day')
-     LIMIT 1`, [id, tenantId, olderThanDays]));
+     LIMIT 1`, [id, tenantId, olderThanDays]);
     return rows.length > 0;
 }

package/dist/form-draft/db/queries/draft-count.js

@@ -4,7 +4,7 @@ import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
 // (64KB); loading up to FORM_DRAFT_MAX_PER_OWNER full rows just to count them
 // would be several MB of wasted transfer per save.
 export async function countDraftsByOwner(db, tenantId, ownerId) {
-    const rows = (await unsafeReadRetrying(db, `SELECT count(*)::int AS "count" FROM "read_form_drafts"
-     WHERE "tenant_id" = $1 AND "owner_id" = $2`, [tenantId, ownerId]));
+    const rows = await unsafeReadRetrying(db, `SELECT count(*)::int AS "count" FROM "read_form_drafts"
+     WHERE "tenant_id" = $1 AND "owner_id" = $2`, [tenantId, ownerId]);
     return rows[0]?.count ?? 0;
 }

package/dist/form-draft/db/queries/owned-file-refs.js

@@ -29,9 +29,9 @@ export async function filterOwnedStorageKeys(db, tenantId, ownerId, candidateKey
 export async function filterOwnedFileRefs(db, tenantId, ownerId, candidateKeys, draftInsertedAt, isCreateMode) {
     if (candidateKeys.length === 0)
         return [];
-    const rows = (await unsafeReadRetrying(db, `SELECT "id", "storage_key" FROM "file_refs"
+    const rows = await unsafeReadRetrying(db, `SELECT "id", "storage_key" FROM "file_refs"
      WHERE "tenant_id" = $1 AND "inserted_by_id" = $2
        AND "storage_key" = ANY($3::text[]) AND "is_deleted" = false
-       AND ($5::boolean OR "inserted_at" > $4::timestamptz)`, [tenantId, ownerId, candidateKeys, draftInsertedAt.toString(), isCreateMode]));
+       AND ($5::boolean OR "inserted_at" > $4::timestamptz)`, [tenantId, ownerId, candidateKeys, draftInsertedAt.toString(), isCreateMode]);
     return rows.map((row) => ({ id: row.id, storageKey: row.storage_key }));
 }

package/dist/form-draft/release-file-refs.js

@@ -1,3 +1,4 @@
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 // The draft blob's `values` is free-form by design (issue #1889: form-draft
 // never knows the consuming form's field schema, only { values, stepIndex,
 // savedAt }). A FileRef pointer is therefore recognised purely by shape —
@@ -6,9 +7,9 @@
 // step writes into the draft, whether under a single "file" field or nested
 // in a "files"/"images" array.
 function isFileRefPointer(value) {
-    if (typeof value !== "object" || value === null)
+    if (!isPlainObject(value))
         return false;
-    const storageKey = value.storageKey;
+    const storageKey = value["storageKey"];
     return typeof storageKey === "string" && storageKey.length > 0;
 }
 function collectStorageKeys(value, keys) {

package/dist/inbound-mail-foundation/handlers/connect-account.write.js

@@ -70,7 +70,7 @@ export const connectAccountHandler = {
             authMethod: payload.authMethod,
             ownerUserId,
             displayName: payload.displayName,
-            address: encryptedFields["address"],
+            address: encryptedFields.address,
             // active ab Connect — der Supervisor greift den Account beim
             // nächsten Tick auf und degradiert ihn bei Credential-Fehlern.
             status: InboundMailAccountStatuses.active,

package/dist/inbound-mail-foundation/handlers/ingest-message.write.js

@@ -165,11 +165,11 @@ export const ingestMessageHandler = {
             ownerUserId: payload.ownerUserId,
             messageIdHeader: effectiveMessageIdHeader,
             threadKey,
-            from: encryptedMessageFields["from"],
-            to: encryptedMessageFields["to"],
-            cc: encryptedMessageFields["cc"],
-            subject: encryptedMessageFields["subject"],
-            snippet: encryptedMessageFields["snippet"],
+            from: encryptedMessageFields.from,
+            to: encryptedMessageFields.to,
+            cc: encryptedMessageFields.cc,
+            subject: encryptedMessageFields.subject,
+            snippet: encryptedMessageFields.snippet,
             receivedAtIso: payload.receivedAtIso,
             bodyRef: payload.bodyRef,
             scope: payload.scope,
@@ -246,7 +246,7 @@ export const ingestMessageHandler = {
             });
             const threadEventPayload = {
                 threadKey,
-                subject: encryptedThreadFields["subject"],
+                subject: encryptedThreadFields.subject,
                 lastMessageAtIso: newLastAt,
                 messageCount,
             };

package/dist/inbound-mail-foundation/handlers/scope-visibility.d.ts

@@ -1,4 +1,4 @@
-export declare function isVisibleToCaller(row: unknown, user: {
+export declare function isVisibleToCaller(row: Readonly<Record<string, unknown>>, user: {
     readonly id: string;
     readonly roles: readonly string[];
 }): boolean;

package/dist/inbound-mail-foundation/oauth-state.js

@@ -11,6 +11,7 @@
 // HMAC-Input, timing-safe compare, Expiry im Klartext-Segment).
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 const STATE_PURPOSE = "inbound-mail-oauth-connect";
 function sign(input, secret) {
     return createHmac("sha256", secret).update(input).digest("base64url");
@@ -60,12 +61,11 @@ export function verifyOAuthState(state, secret, now = Temporal.Now.instant()) {
     return { ok: true, payload: parsed };
 }
 function isOAuthStatePayload(v) {
-    if (typeof v !== "object" || v === null)
+    if (!isPlainObject(v))
         return false;
-    const o = v;
-    return (typeof o["tenantId"] === "string" &&
-        (o["ownerUserId"] === null || typeof o["ownerUserId"] === "string") &&
-        typeof o["providerKey"] === "string" &&
-        typeof o["mailbox"] === "string" &&
-        typeof o["nonce"] === "string");
+    return (typeof v["tenantId"] === "string" &&
+        (v["ownerUserId"] === null || typeof v["ownerUserId"] === "string") &&
+        typeof v["providerKey"] === "string" &&
+        typeof v["mailbox"] === "string" &&
+        typeof v["nonce"] === "string");
 }

package/dist/inbound-mail-foundation/types.js

@@ -64,14 +64,14 @@ export class InboundTransientError extends Error {
     }
 }
 export function isInboundAuthError(e) {
-    return e instanceof Error && e.kind === "inbound-auth-error";
+    return e instanceof Error && "kind" in e && e.kind === "inbound-auth-error";
 }
 export function isInboundRateLimitError(e) {
-    return e instanceof Error && e.kind === "inbound-rate-limit-error";
+    return e instanceof Error && "kind" in e && e.kind === "inbound-rate-limit-error";
 }
 export function isInboundCursorInvalidError(e) {
-    return e instanceof Error && e.kind === "inbound-cursor-invalid-error";
+    return e instanceof Error && "kind" in e && e.kind === "inbound-cursor-invalid-error";
 }
 export function isInboundTransientError(e) {
-    return e instanceof Error && e.kind === "inbound-transient-error";
+    return e instanceof Error && "kind" in e && e.kind === "inbound-transient-error";
 }

package/dist/inbound-mail-foundation/watch-supervisor.js

@@ -46,6 +46,7 @@
 import { fetchOne, insertOne, selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, decryptPiiFieldValues, } from "@cosmicdrift/kumiko-framework/crypto";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { InboundMailAccountStatuses, InboundMailFoundationHandlers } from "./constants.js";
 import { MAIL_ACCOUNT_PII_FIELDS, syncCursorTable } from "./entities.js";
 import { createOAuthAccessTokenManager, usesFoundationManagedOAuth, } from "./oauth-access-token.js";
@@ -111,20 +112,27 @@ export function createInboundMailSupervisor(deps) {
         });
         const piiKms = configuredPiiSubjectKms();
         const records = [];
-        for (const raw of rows) {
-            const row = piiKms
-                ? await decryptPiiFieldValues(raw, MAIL_ACCOUNT_PII_FIELDS, piiKms, { requestId: "inbound-mail-foundation:supervisor:list-accounts" })
-                : raw;
+        for (const row of rows) {
+            const decrypted = piiKms
+                ? await decryptPiiFieldValues(row, MAIL_ACCOUNT_PII_FIELDS, piiKms, {
+                    requestId: "inbound-mail-foundation:supervisor:list-accounts",
+                })
+                : row;
+            const decryptedAddress = decrypted["address"];
+            // Falling back to row.address would hand the ciphertext to a provider.
+            if (typeof decryptedAddress !== "string") {
+                throw new Error(`inbound-mail: address of mail account ${row.id} did not decrypt to text`);
+            }
             records.push({
-                id: row["id"],
-                tenantId: row["tenantId"],
-                provider: row["provider"],
-                authMethod: row["authMethod"],
-                ownerUserId: row["ownerUserId"] ?? null,
-                address: row["address"],
-                displayName: row["displayName"] ?? "",
+                id: row.id,
+                tenantId: row.tenantId,
+                provider: row.provider,
+                authMethod: row.authMethod,
+                ownerUserId: row.ownerUserId ?? null,
+                address: decryptedAddress,
+                displayName: row.displayName ?? "",
                 status: InboundMailAccountStatuses.active,
-                watchState: row["watchState"] ?? "idle",
+                watchState: row.watchState ?? "idle",
             });
         }
         return records;
@@ -140,7 +148,8 @@ export function createInboundMailSupervisor(deps) {
         if (!row)
             return null;
         try {
-            return JSON.parse(row.cursor); // @cast-boundary eigene JSON-Persistenz
+            const parsed = JSON.parse(row.cursor);
+            return isPlainObject(parsed) ? parsed : null;
         }
         catch {
             return null; // korrupter Cursor = wie kein Cursor → Backfill, Dedup fängt Dubletten

package/dist/inbound-provider-imap/imap-client.js

@@ -6,6 +6,7 @@ import { InboundAuthError, InboundCursorInvalidError, InboundTransientError, } f
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { legacyDateToInstant } from "@cosmicdrift/kumiko-framework/time";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { ImapFlow } from "imapflow";
 import { simpleParser } from "mailparser";
 export const IMAP_MAILBOX = "INBOX";
@@ -73,10 +74,10 @@ export function mapImapError(err, host) {
     // imapflow-Fehler tragen die Server-Antwort in responseText, die
     // message ist nur "Command failed" — beides in den Match einbeziehen;
     // authenticationFailed ist das verlässliche Flag.
-    const carrier = err;
-    const responseText = typeof carrier?.responseText === "string" ? carrier.responseText : "";
+    const carrier = isPlainObject(err) ? err : undefined;
+    const responseText = typeof carrier?.["responseText"] === "string" ? carrier["responseText"] : "";
     const msg = `${err instanceof Error ? err.message : String(err)} ${responseText}`.trim();
-    if (carrier?.authenticationFailed === true ||
+    if (carrier?.["authenticationFailed"] === true ||
         /auth(entication)? failed|invalid credentials|invalid login|LOGIN failed|AUTHENTICATIONFAILED/i.test(msg)) {
         return new InboundAuthError(`IMAP auth failed at ${host}: ${msg}`);
     }