@cosmicdrift/kumiko-framework 0.306.0 → 0.308.0

package/src/pipeline/__tests__/idempotency-transient-failure.integration.test.ts

@@ -1,5 +1,5 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { createEventStoreExecutor } from "../../db/event-store-executor";
 import { asRawClient, selectMany } from "../../db/query";
 import { buildEntityTable } from "../../db/table-builder";

package/src/pipeline/__tests__/job-trigger-consumer.integration.test.ts

@@ -17,7 +17,7 @@
 // produce, not something exercised end-to-end by any test today.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { entityEventName } from "../../db";
 import { defineFeature } from "../../engine";
 import { createInMemoryFileProvider, type InMemoryFileProvider } from "../../files";

package/src/pipeline/__tests__/lifecycle-pipeline.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, spyOn, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import {
   createEntity,
   createRegistry,

package/src/pipeline/__tests__/load-aggregate-query.integration.test.ts

@@ -10,7 +10,7 @@
 
 import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
 import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
-import { z } from "zod";
+import * as z from "zod";
 import type { DbConnection, DbTx } from "../../db/connection";
 import { createEventStoreExecutor } from "../../db/event-store-executor";
 import { buildEntityTable } from "../../db/table-builder";

package/src/pipeline/__tests__/msp-multi-hop.integration.test.ts

@@ -11,7 +11,7 @@
 //   5. ctx.loadAggregate reads the triggering stream's full history.
 
 import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { createEventStoreExecutor } from "../../db/event-store-executor";
 import { selectMany } from "../../db/query";
 import { buildEntityTable } from "../../db/table-builder";

package/src/pipeline/__tests__/msp-rebuild.integration.test.ts

@@ -17,7 +17,8 @@
 
 import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
 import { sql } from "@cosmicdrift/kumiko-framework/db";
-import { z } from "zod";
+import * as z from "zod";
+import type { DbConnection, DbTx } from "../../db/connection";
 import { integer as pgInteger, table as pgTable, uuid as pgUuid } from "../../db/dialect";
 import { createEventStoreExecutor } from "../../db/event-store-executor";
 import { asRawClient, selectMany, updateMany } from "../../db/query";
@@ -35,6 +36,8 @@ import {
   TestUsers,
   unsafeCreateEntityTable,
 } from "../../stack";
+import { waitFor } from "../../testing";
+import { SHARED_INSTANCE_SENTINEL } from "../event-consumer-state";
 
 // --- Fixtures: two aggregates feeding one MSP + two cornered MSPs ---
 
@@ -69,6 +72,10 @@ const sagaStateTable = pgTable("read_mspreb_saga_state", {
   id: pgUuid("id").primaryKey(),
 });
 
+// Captured for the raw-SQL out-of-order-commit test below, which appends
+// events directly (bypassing the write handler) to control commit timing.
+let invoiceBilledEventName = "";
+
 const feature = defineFeature("mspreb", (r) => {
   r.entity("msp-reb-invoice", invoiceEntity);
   r.entity("msp-reb-payment", paymentEntity);
@@ -78,6 +85,7 @@ const feature = defineFeature("mspreb", (r) => {
     z.object({ customer: z.uuid(), cents: z.number().int() }),
     { piiFields: "none" },
   );
+  invoiceBilledEventName = invoiceBilled.name;
   const paymentReceived = r.defineEvent(
     "payment-received",
     z.object({ customer: z.uuid(), cents: z.number().int() }),
@@ -231,6 +239,47 @@ async function runFullDispatcher(): Promise<void> {
   await stack.eventDispatcher?.runOnce();
 }
 
+// Appends an invoice-billed event directly (not via the write handler) so
+// the caller controls exactly when its id is committed and visible. `version`
+// must be distinct per call for the SAME aggregateId — a repeated version on
+// an uncommitted row makes Postgres block the second INSERT until the first
+// transaction resolves (unique-constraint ambiguity), which would deadlock
+// against a caller still holding that first transaction open.
+async function insertInvoiceBilledEvent(
+  db: DbConnection | DbTx,
+  customer: string,
+  cents: number,
+  version: number,
+): Promise<void> {
+  await asRawClient(db).unsafe(
+    `INSERT INTO "kumiko_events"
+       (aggregate_id, aggregate_type, tenant_id, version, type, payload, metadata, created_by)
+     VALUES ($1::uuid, 'msp-reb-invoice', $2::uuid, $3, $4, $5::jsonb, '{}'::jsonb, 'test')`,
+    [
+      customer,
+      admin.tenantId,
+      version,
+      invoiceBilledEventName,
+      JSON.stringify({ customer, cents }),
+    ],
+  );
+}
+
+async function readPendingGaps(
+  consumerName: string,
+): Promise<ReadonlyArray<{ from: string; to: string; xmax: string }>> {
+  const rows = (await asRawClient(stack.db).unsafe(
+    `SELECT "pending_gaps", jsonb_typeof("pending_gaps") AS kind FROM "kumiko_event_consumers" WHERE "name" = $1 AND "instance_id" = $2`,
+    [consumerName, SHARED_INSTANCE_SENTINEL],
+  )) as ReadonlyArray<{
+    pending_gaps: ReadonlyArray<{ from: string; to: string; xmax: string }>;
+    kind: string;
+  }>;
+  // A double-encoded write lands as a jsonb string scalar, not an array.
+  if (rows[0] && rows[0].kind !== "array") throw new Error(`pending_gaps is jsonb ${rows[0].kind}`);
+  return rows[0]?.pending_gaps ?? [];
+}
+
 // --- Tests ---
 
 describe("rebuildMultiStreamProjection — rebuildable read-model", () => {
@@ -310,6 +359,72 @@ describe("rebuildMultiStreamProjection — rebuildable read-model", () => {
     const [row] = await selectMany(stack.db, balanceTable, { customer: carol });
     expect(row).toMatchObject({ invoicesCents: 42_00, paymentsCents: 0 });
   });
+
+  test("rebuild handoff seeds a pending gap for a lower-id write still open during replay, and the live dispatcher delivers it exactly once (#3231)", async () => {
+    const frank = "00000000-0000-4000-8000-00000000f106";
+    await updateMany(
+      stack.db,
+      eventConsumerStateTable,
+      { status: "disabled", updatedAt: sql`now()` },
+      { name: SAGA_MSP },
+    );
+
+    // Tx A grabs the LOW id first but holds its transaction open —
+    // uncommitted, so it's invisible to the rebuild's horizon read below.
+    let releaseA!: () => void;
+    const aGate = new Promise<void>((resolve) => {
+      releaseA = resolve;
+    });
+    let markAInserted!: () => void;
+    const aInserted = new Promise<void>((resolve) => {
+      markAInserted = resolve;
+    });
+    const aDone = stack.db
+      .begin(async (tx: DbTx) => {
+        await insertInvoiceBilledEvent(tx, frank, 1_00, 1);
+        markAInserted();
+        await aGate;
+      })
+      .catch(() => {});
+    await aInserted;
+
+    // Commits AFTER A grabbed its id, so it's the higher, only-visible id
+    // when the rebuild reads its horizon.
+    await insertInvoiceBilledEvent(stack.db, frank, 100_00, 2);
+
+    try {
+      const result = await rebuildMultiStreamProjection(BALANCE_MSP, {
+        db: stack.db,
+        registry: stack.registry,
+      });
+      // Only the visible (higher-id) event was replayed — A's row is still
+      // invisible, so it must not be double-counted once it does arrive.
+      const [afterRebuild] = await selectMany(stack.db, balanceTable, { customer: frank });
+      expect(afterRebuild).toMatchObject({ invoicesCents: 100_00 });
+      expect(result.lastProcessedEventId).toBeGreaterThan(0n);
+
+      const gapsAfterRebuild = await readPendingGaps(BALANCE_MSP);
+      expect(gapsAfterRebuild).not.toEqual([]);
+    } finally {
+      releaseA();
+      await aDone;
+    }
+
+    // A commits now — the live dispatcher must deliver it exactly once via
+    // the seeded pending gap, landing at 1_00 + 100_00, not double-applied.
+    await waitFor(
+      async () => {
+        await runFullDispatcher();
+        const [row] = await selectMany(stack.db, balanceTable, { customer: frank });
+        expect(row).toMatchObject({ invoicesCents: 101_00 });
+        expect(await readPendingGaps(BALANCE_MSP)).toEqual([]);
+      },
+      { delays: [20, 100, 500, 1000, 3000] },
+    );
+
+    const [finalRow] = await selectMany(stack.db, balanceTable, { customer: frank });
+    expect(finalRow).toMatchObject({ invoicesCents: 101_00 });
+  });
 });
 
 describe("rebuildMultiStreamProjection — guard rails", () => {

package/src/pipeline/__tests__/multi-stream-projection.integration.test.ts

@@ -7,7 +7,7 @@
 // per MSP consumer, dead-letters on repeated handler failures.
 
 import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { integer as pgInteger, table as pgTable, uuid as pgUuid } from "../../db/dialect";
 import { createEventStoreExecutor } from "../../db/event-store-executor";
 import { asRawClient, selectMany } from "../../db/query";

package/src/pipeline/__tests__/pending-gap-ranges.test.ts

@@ -0,0 +1,94 @@
+import { describe, expect, test } from "bun:test";
+import type { PendingGapEntry } from "../event-consumer-state";
+import { capPendingGapsBelowCursor, subtractSortedIdsFromRanges } from "../pending-gap-ranges";
+
+function gap(from: string, to: string, xmax = "100"): PendingGapEntry {
+  return { from, to, xmax };
+}
+
+describe("subtractSortedIdsFromRanges", () => {
+  test("no ids leaves ranges unchanged", () => {
+    const ranges = [gap("10", "20")];
+    expect(subtractSortedIdsFromRanges(ranges, [])).toEqual([gap("10", "20")]);
+  });
+
+  test("id in the middle of a range splits it in two", () => {
+    const ranges = [gap("10", "20")];
+    expect(subtractSortedIdsFromRanges(ranges, [15n])).toEqual([gap("10", "14"), gap("16", "20")]);
+  });
+
+  test("ids at from- and to-boundary shrink the range from inside", () => {
+    const ranges = [gap("10", "20")];
+    expect(subtractSortedIdsFromRanges(ranges, [10n, 20n])).toEqual([gap("11", "19")]);
+  });
+
+  test("all ids of a range make it disappear", () => {
+    const ranges = [gap("10", "12")];
+    expect(subtractSortedIdsFromRanges(ranges, [10n, 11n, 12n])).toEqual([]);
+  });
+
+  test("ids between, before and after ranges affect nothing", () => {
+    const ranges = [gap("10", "20"), gap("30", "40")];
+    expect(subtractSortedIdsFromRanges(ranges, [5n, 25n, 45n])).toEqual([
+      gap("10", "20"),
+      gap("30", "40"),
+    ]);
+  });
+
+  test("multiple ranges with ids spread across them use a single pointer pass", () => {
+    const ranges = [gap("10", "20"), gap("30", "40"), gap("50", "60")];
+    const ids = [15n, 30n, 40n, 55n];
+    expect(subtractSortedIdsFromRanges(ranges, ids)).toEqual([
+      gap("10", "14"),
+      gap("16", "20"),
+      gap("31", "39"),
+      gap("50", "54"),
+      gap("56", "60"),
+    ]);
+  });
+
+  test("xmax is preserved on every surviving part", () => {
+    const ranges = [gap("10", "20", "999")];
+    expect(subtractSortedIdsFromRanges(ranges, [15n])).toEqual([
+      gap("10", "14", "999"),
+      gap("16", "20", "999"),
+    ]);
+  });
+});
+
+describe("capPendingGapsBelowCursor", () => {
+  test("cursor 0n caps everything away", () => {
+    const ranges = [gap("10", "20")];
+    expect(capPendingGapsBelowCursor(ranges, 0n)).toEqual([]);
+  });
+
+  test("range fully below cursor is unchanged", () => {
+    const ranges = [gap("10", "20")];
+    expect(capPendingGapsBelowCursor(ranges, 100n)).toEqual([gap("10", "20")]);
+  });
+
+  test("range straddling the cursor is truncated to cursor - 1", () => {
+    const ranges = [gap("10", "20")];
+    expect(capPendingGapsBelowCursor(ranges, 15n)).toEqual([gap("10", "14")]);
+  });
+
+  test("range with to == cursor is truncated to cursor - 1", () => {
+    const ranges = [gap("10", "20")];
+    expect(capPendingGapsBelowCursor(ranges, 20n)).toEqual([gap("10", "19")]);
+  });
+
+  test("range with from == cursor is dropped entirely", () => {
+    const ranges = [gap("20", "30")];
+    expect(capPendingGapsBelowCursor(ranges, 20n)).toEqual([]);
+  });
+
+  test("range with from > cursor is dropped entirely", () => {
+    const ranges = [gap("25", "30")];
+    expect(capPendingGapsBelowCursor(ranges, 20n)).toEqual([]);
+  });
+
+  test("xmax is preserved on surviving ranges", () => {
+    const ranges = [gap("10", "20", "777")];
+    expect(capPendingGapsBelowCursor(ranges, 15n)).toEqual([gap("10", "14", "777")]);
+  });
+});

package/src/pipeline/__tests__/post-query-hook.integration.test.ts

@@ -10,7 +10,7 @@
 // nicht createTestDispatcher.
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { createEntity, createTextField, defineFeature } from "../../engine";
 import type { PostQueryHookFn } from "../../engine/types";
 import { setupTestStack, type TestStack, TestUsers } from "../../stack";

package/src/pipeline/__tests__/public-intake-runtime-gate.integration.test.ts

@@ -2,12 +2,13 @@
 // so the static boot check passes and only the runtime gate can stop the write.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import type { SchemaTable } from "../../db";
+import type { DbRunner } from "../../db/connection";
 import { createEventStoreExecutor } from "../../db/event-store-executor";
-import { asRawClient, selectMany } from "../../db/query";
+import { asRawClient, runInSavepoint, selectMany } from "../../db/query";
 import { buildEntityTable } from "../../db/table-builder";
-import type { TenantDb } from "../../db/tenant-db";
+import { createTenantDb, type TenantDb } from "../../db/tenant-db";
 import { createEntity, createSystemUser, createTextField, defineFeature } from "../../engine";
 import { SYSTEM_ROLE } from "../../engine/system-user";
 import type { TenantId } from "../../engine/types";
@@ -273,6 +274,185 @@ const featureA = defineFeature("intakea", (r) => {
     },
     { access: { roles: ["anonymous", "Admin"] }, rateLimit: RATE_LIMIT },
   );
+
+  // (g) createTenantDb() built by the HANDLER ITSELF from ctx.db.unsafeRaw(reason) — the
+  // returned runner carries no TenantDb of its own, so without gate inheritance on the
+  // runner (tenant-db.ts's runnerPersonalDataGates) this fresh TenantDb would have no gate.
+  const UNSAFE_RAW_REASON =
+    "test: proves createTenantDb() built from ctx.db.unsafeRaw() inherits the caller's personal-data gate";
+
+  r.writeHandler(
+    "unsafe-raw-tenant-db-no-declare",
+    z.object({ note: z.string() }),
+    async (event, ctx) => {
+      const raw = ctx.db.unsafeRaw(UNSAFE_RAW_REASON);
+      await createTenantDb(raw, event.user.tenantId, "system").insertOne(
+        contactTable as unknown as SchemaTable,
+        { email: "leak-unsafe-raw@example.com", note: event.payload.note },
+      );
+      return { isSuccess: true as const, data: { ok: true as const } };
+    },
+    {
+      access: { roles: ["anonymous"] },
+      rateLimit: RATE_LIMIT,
+      escapeHatch: { reason: UNSAFE_RAW_REASON },
+    },
+  );
+
+  r.writeHandler(
+    "unsafe-raw-tenant-db-declare",
+    z.object({ note: z.string() }),
+    async (event, ctx) => {
+      const raw = ctx.db.unsafeRaw(UNSAFE_RAW_REASON);
+      await createTenantDb(raw, event.user.tenantId, "system").insertOne(
+        contactTable as unknown as SchemaTable,
+        { email: "leak-unsafe-raw-declared@example.com", note: event.payload.note },
+      );
+      return { isSuccess: true as const, data: { ok: true as const } };
+    },
+    {
+      access: { roles: ["anonymous"], personalData: "public-intake" },
+      rateLimit: RATE_LIMIT,
+      escapeHatch: { reason: UNSAFE_RAW_REASON },
+    },
+  );
+
+  // Nested tx: the handler already runs inside the request's own transaction, so its
+  // unsafeRaw runner is a tx handle (.savepoint, not .begin — see asRawClient's own
+  // comment). The savepoint-scoped tx a callback receives must inherit the same gate,
+  // otherwise a handler could dodge the gate by moving the write inside a savepoint.
+  r.writeHandler(
+    "unsafe-raw-savepoint-tenant-db-no-declare",
+    z.object({ note: z.string() }),
+    async (event, ctx) => {
+      const raw = ctx.db.unsafeRaw(UNSAFE_RAW_REASON);
+      await runInSavepoint(raw, async (sp) => {
+        await createTenantDb(sp as DbRunner, event.user.tenantId, "system").insertOne(
+          contactTable as unknown as SchemaTable,
+          { email: "leak-unsafe-raw-tx@example.com", note: event.payload.note },
+        );
+      });
+      return { isSuccess: true as const, data: { ok: true as const } };
+    },
+    {
+      access: { roles: ["anonymous"] },
+      rateLimit: RATE_LIMIT,
+      escapeHatch: { reason: UNSAFE_RAW_REASON },
+    },
+  );
+
+  r.writeHandler(
+    "unsafe-raw-savepoint-tenant-db-declare",
+    z.object({ note: z.string() }),
+    async (event, ctx) => {
+      const raw = ctx.db.unsafeRaw(UNSAFE_RAW_REASON);
+      await runInSavepoint(raw, async (sp) => {
+        await createTenantDb(sp as DbRunner, event.user.tenantId, "system").insertOne(
+          contactTable as unknown as SchemaTable,
+          { email: "leak-unsafe-raw-tx-declared@example.com", note: event.payload.note },
+        );
+      });
+      return { isSuccess: true as const, data: { ok: true as const } };
+    },
+    {
+      access: { roles: ["anonymous"], personalData: "public-intake" },
+      rateLimit: RATE_LIMIT,
+      escapeHatch: { reason: UNSAFE_RAW_REASON },
+    },
+  );
+
+  // Raw SQL through the gated proxy itself must stay ungated (decision: unsafeRaw's raw SQL
+  // is an escape hatch + audit trail, not something the personal-data gate blocks) — this
+  // just proves the proxy stays transparent for a direct tagged-template call.
+  r.writeHandler(
+    "unsafe-raw-tagged-query-declare",
+    z.object({ note: z.string() }),
+    async (event, ctx) => {
+      const raw = ctx.db.unsafeRaw(UNSAFE_RAW_REASON);
+      // @cast-boundary test-fixture — DbRunner's RawClient arm has no tagged-template call
+      // signature; the underlying driver instance (postgres-js/Bun.SQL) does.
+      const tagged = raw as unknown as (
+        strings: TemplateStringsArray,
+        ...values: unknown[]
+      ) => Promise<readonly Record<string, unknown>[]>;
+      const rows = await tagged`SELECT 1 AS one`;
+      if (rows[0]?.["one"] !== 1) throw new Error("tagged query through the proxy failed");
+      await createTenantDb(raw, event.user.tenantId, "system").insertOne(
+        contactTable as unknown as SchemaTable,
+        { email: "leak-unsafe-raw-tagged@example.com", note: event.payload.note },
+      );
+      return { isSuccess: true as const, data: { ok: true as const } };
+    },
+    {
+      access: { roles: ["anonymous"], personalData: "public-intake" },
+      rateLimit: RATE_LIMIT,
+      escapeHatch: { reason: UNSAFE_RAW_REASON },
+    },
+  );
+
+  // Authenticated session: same ctx.db.unsafeRaw() -> createTenantDb() path, but the root
+  // isn't anonymous, so ctx.db carries no personal-data gate to inherit — unaffected.
+  r.writeHandler(
+    "unsafe-raw-tenant-db-authenticated",
+    z.object({ note: z.string() }),
+    async (event, ctx) => {
+      const raw = ctx.db.unsafeRaw(UNSAFE_RAW_REASON);
+      await createTenantDb(raw, event.user.tenantId, "system").insertOne(
+        contactTable as unknown as SchemaTable,
+        { email: "leak-unsafe-raw-authenticated@example.com", note: event.payload.note },
+      );
+      return { isSuccess: true as const, data: { ok: true as const } };
+    },
+    { access: { roles: ["Admin"] }, escapeHatch: { reason: UNSAFE_RAW_REASON } },
+  );
+
+  // The CRUD executor writes through tenantDbRunner + assertPersonalDataWrite, not
+  // insertOne — a TenantDb inheriting its gate only from the runner (not from an explicit
+  // grants.personalDataGate) must gate the executor path too, not just direct insertOne.
+  r.writeHandler(
+    "unsafe-raw-executor-no-declare",
+    z.object({ note: z.string() }),
+    async (event, ctx) => {
+      const scopedDb = createTenantDb(
+        ctx.db.unsafeRaw(UNSAFE_RAW_REASON),
+        event.user.tenantId,
+        "system",
+      );
+      const crud = createEventStoreExecutor(contactTable, contactEntity, { entityName: "contact" });
+      return crud.create(
+        { email: "leak-unsafe-raw-executor@example.com", note: event.payload.note },
+        event.user,
+        scopedDb,
+      );
+    },
+    {
+      access: { roles: ["anonymous"] },
+      rateLimit: RATE_LIMIT,
+      escapeHatch: { reason: UNSAFE_RAW_REASON },
+    },
+  );
+
+  // Same inherited-gate TenantDb, but only a non-PII field — proves the proxy/executor
+  // combination still appends events and lets the projection run when there is nothing
+  // for the gate to block, not merely that it throws.
+  r.writeHandler(
+    "unsafe-raw-executor-non-pii-no-declare",
+    z.object({ note: z.string() }),
+    async (event, ctx) => {
+      const scopedDb = createTenantDb(
+        ctx.db.unsafeRaw(UNSAFE_RAW_REASON),
+        event.user.tenantId,
+        "system",
+      );
+      const crud = createEventStoreExecutor(probeTable, probeEntity, { entityName: "probe" });
+      return crud.create({ note: event.payload.note }, event.user, scopedDb);
+    },
+    {
+      access: { roles: ["anonymous"] },
+      rateLimit: RATE_LIMIT,
+      escapeHatch: { reason: UNSAFE_RAW_REASON },
+    },
+  );
 });
 
 describe("public-intake runtime gate", () => {
@@ -422,4 +602,83 @@ describe("public-intake runtime gate", () => {
     expect(res.status).toBe(200);
     expect(await rowCount()).toBe(1);
   });
+
+  test("(g) createTenantDb(ctx.db.unsafeRaw(reason), ...) — blocked without declaration", async () => {
+    const res = await stack.http.raw("POST", "/api/write", {
+      type: "intakea:write:unsafe-raw-tenant-db-no-declare",
+      payload: { note: "x" },
+    });
+    expect(res.status).toBe(403);
+    const body = (await res.json()) as { error: { details: { reason: string } } };
+    expect(body.error.details.reason).toBe("public_intake_required");
+    expect(await rowCount()).toBe(0);
+  });
+
+  test("(g) createTenantDb(ctx.db.unsafeRaw(reason), ...) — allowed once declared", async () => {
+    const res = await stack.http.raw("POST", "/api/write", {
+      type: "intakea:write:unsafe-raw-tenant-db-declare",
+      payload: { note: "x" },
+    });
+    expect(res.status).toBe(200);
+    expect(await rowCount()).toBe(1);
+  });
+
+  test("(g) createTenantDb(tx, ...) inside savepoint() — blocked without declaration", async () => {
+    const res = await stack.http.raw("POST", "/api/write", {
+      type: "intakea:write:unsafe-raw-savepoint-tenant-db-no-declare",
+      payload: { note: "x" },
+    });
+    expect(res.status).toBe(403);
+    const body = (await res.json()) as { error: { details: { reason: string } } };
+    expect(body.error.details.reason).toBe("public_intake_required");
+    expect(await rowCount()).toBe(0);
+  });
+
+  test("(g) createTenantDb(tx, ...) inside savepoint() — allowed once declared", async () => {
+    const res = await stack.http.raw("POST", "/api/write", {
+      type: "intakea:write:unsafe-raw-savepoint-tenant-db-declare",
+      payload: { note: "x" },
+    });
+    expect(res.status).toBe(200);
+    expect(await rowCount()).toBe(1);
+  });
+
+  test("(g) a tagged-template query through the gated unsafeRaw proxy still works", async () => {
+    const res = await stack.http.raw("POST", "/api/write", {
+      type: "intakea:write:unsafe-raw-tagged-query-declare",
+      payload: { note: "x" },
+    });
+    expect(res.status).toBe(200);
+    expect(await rowCount()).toBe(1);
+  });
+
+  test("(g) authenticated session on the same unsafeRaw->createTenantDb path — unaffected", async () => {
+    const res = await stack.http.write(
+      "intakea:write:unsafe-raw-tenant-db-authenticated",
+      { note: "x" },
+      TestUsers.admin,
+    );
+    expect(res.status).toBe(200);
+    expect(await rowCount()).toBe(1);
+  });
+
+  test("(g) createEventStoreExecutor.create through an inherited-gate TenantDb — blocked without declaration", async () => {
+    const res = await stack.http.raw("POST", "/api/write", {
+      type: "intakea:write:unsafe-raw-executor-no-declare",
+      payload: { note: "x" },
+    });
+    expect(res.status).toBe(403);
+    const body = (await res.json()) as { error: { details: { reason: string } } };
+    expect(body.error.details.reason).toBe("public_intake_required");
+    expect(await rowCount()).toBe(0);
+  });
+
+  test("(g) createEventStoreExecutor.create of a non-PII field through the same inherited-gate TenantDb — allowed", async () => {
+    const res = await stack.http.raw("POST", "/api/write", {
+      type: "intakea:write:unsafe-raw-executor-non-pii-no-declare",
+      payload: { note: "x" },
+    });
+    expect(res.status).toBe(200);
+    expect(await probeRowCount()).toBe(1);
+  });
 });

package/src/pipeline/__tests__/query-projection.integration.test.ts

@@ -5,7 +5,7 @@
 // grant — r.systemScope() or a declared escapeHatch on the handler.
 
 import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import {
   integer as pgInteger,
   table as pgTable,

package/src/pipeline/__tests__/rate-limit-default.integration.test.ts

@@ -4,7 +4,7 @@
 // rate-limit/__tests__/dispatcher-l3.integration.test.ts.
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { createSystemUser, defineFeature } from "../../engine";
 import type { RateLimitConfig, RateLimitDecision, RateLimitResolver } from "../../rate-limit";
 import { createTestUser, setupTestStack, type TestStack, testTenantId } from "../../stack";

package/src/pipeline/__tests__/rebuild-poison-quarantine.integration.test.ts

@@ -15,7 +15,7 @@
 //   - SQL error (aborts the tx → proves the savepoint is load-bearing)
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { integer as pgInteger, table as pgTable, uuid as pgUuid } from "../../db/dialect";
 import { createEventStoreExecutor } from "../../db/event-store-executor";
 import { asRawClient } from "../../db/query";

package/src/pipeline/__tests__/search-consumer-named-events.integration.test.ts

@@ -3,7 +3,7 @@
 // the search index. The event payload only carries the named event's own
 // field slice, so the consumer reads the live projection row instead.
 import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { asRawClient, buildEntityTable, createEventStoreExecutor, createTenantDb } from "../../db";
 import { createEntity, createTextField, defineFeature } from "../../engine";
 import {

package/src/pipeline/__tests__/system-identity-switch.integration.test.ts

@@ -2,7 +2,7 @@
 // r.systemScope() or { escapeHatch }. Real HTTP calls + setupTestStack — never createTestDispatcher.
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { createEventStoreExecutor } from "../../db/event-store-executor";
 import { buildEntityTable } from "../../db/table-builder";
 import {

package/src/pipeline/__tests__/try-append-event.integration.test.ts

@@ -21,7 +21,7 @@
 // may pick either writer as the winner.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { createEventStoreExecutor } from "../../db/event-store-executor";
 import { asRawClient, selectMany } from "../../db/query";
 import { buildEntityTable } from "../../db/table-builder";