@cosmicdrift/kumiko-framework 0.327.0 → 0.328.1

package/src/engine/escape-hatch-declaration.ts

@@ -1,7 +0,0 @@
-import type { EscapeHatchDeclaration } from "@cosmicdrift/kumiko-types/handlers";
-
-// Marks a standalone helper that escalates on a HandlerContext handed to it
-// by its caller. The caller's registration carries the escapeHatch that
-// authorizes it; this call makes the escalation visible at the site where it
-// happens, where the guard and a reviewer both see it.
-export function declareEscapeHatch(_declaration: EscapeHatchDeclaration): void {}

package/src/engine/event-helpers.ts

@@ -1,73 +0,0 @@
-import type { AppendEventArgs, EventDef, HandlerContext } from "./types/handlers";
-
-// The ctx-surface emitEvent needs. Accepting the narrow shape lets tests or
-// MultiStreamApplyContext-style callers pass their own appendEvent without
-// a full HandlerContext. Real handlers just pass `ctx`.
-//
-// Uses unsafeAppendEvent internally because EventDef's TPayload comes from
-// a runtime-defined zod-schema — emitEvent does the type-check itself via
-// the EventDef generic, so it doesn't need the strict KumikoEventTypeMap
-// path. The strict appendEvent is for direct in-handler callsites.
-export type EmitCtx = Pick<HandlerContext, "unsafeAppendEvent">;
-
-// Typed wrapper around ctx.appendEvent. Two wins over the raw call:
-//
-//   1. The payload is checked against the EventDef's inferred TPayload,
-//      so a Zod-schema mismatch becomes a compile error at the emit site
-//      rather than a runtime reject from the event-store append.
-//   2. The event name is carried by the def — no hand-typed
-//      "<feature>:event:<short>" string, no typos.
-//
-//   await emitEvent(ctx, orderPlaced, {
-//     aggregateId: String(result.data.id),
-//     aggregateType: "pubsub-order",
-//     payload: { id, customer, product },
-//   });
-//
-// aggregateType stays explicit on purpose — the EventDef doesn't know which
-// aggregate owns an event (cross-feature reuse is legal). Use the raw
-// ctx.appendEvent when the event name is computed at runtime.
-export async function emitEvent<TPayload>(
-  ctx: EmitCtx,
-  eventDef: EventDef<TPayload>,
-  args: {
-    readonly aggregateId: string;
-    readonly aggregateType: string;
-    readonly payload: TPayload;
-  },
-): Promise<void> {
-  const appendArgs: AppendEventArgs = {
-    aggregateId: args.aggregateId,
-    aggregateType: args.aggregateType,
-    type: eventDef.name,
-    payload: args.payload,
-  };
-  await ctx.unsafeAppendEvent(appendArgs);
-}
-
-// Read-side counterpart: narrow a StoredEvent's `payload` (declared as
-// `Record<string, unknown>` because a stream carries many event types) to
-// the EventDef's inferred TPayload. Replaces the scattered
-// `event.payload as { ... }` casts inside projection-apply handlers and
-// reducers — the cast is named, the shape comes from a single source
-// (the defineEvent() schema), and a mismatched event-type throws loudly.
-//
-//   const p = typedPayload(event, approved);
-//   // p is typed as { amountCents: number; approvedBy: string }
-//
-// The runtime type-check guards against projection-apply maps that hand-
-// build their key → handler mapping and accidentally route events to the
-// wrong typedPayload call. No Zod-parse — validation happened at
-// appendEvent time; this is a read-path helper.
-export function typedPayload<TPayload>(
-  event: { readonly type: string; readonly payload: Record<string, unknown> },
-  eventDef: EventDef<TPayload>,
-): TPayload {
-  if (event.type !== eventDef.name) {
-    throw new Error(
-      `[Kumiko] typedPayload: event type "${event.type}" does not match EventDef "${eventDef.name}". ` +
-        `Check the projection-apply / reducer mapping — the event was routed to the wrong handler.`,
-    );
-  }
-  return event.payload as TPayload; // @cast-boundary engine-payload
-}

package/src/engine/extension-names.ts

@@ -1,242 +0,0 @@
-import type { DerivativeRendererPlugin } from "@cosmicdrift/kumiko-types/derivatives-types";
-import type { OverlayResolverPlugin } from "../derivatives/derivatives-context";
-import type { FileProviderPlugin } from "../files/provider-resolver";
-import type { PrincipalStatusPlugin, TenantLifecycleStatusPlugin } from "./active-membership";
-import type { TenantDataExtensionHooks } from "./extensions/tenant-data";
-import type { TenantResourceExtensionHooks } from "./extensions/tenant-resource";
-import type { UserDataExtensionOptions } from "./extensions/user-data";
-import { TENANT_TIER_RESOLVER_EXT, type TierResolverPlugin } from "./tier-resolver-extension";
-
-// Standardisierte Extension-Namen fuer Datenschutz-Hook-Achsen.
-//
-// Features registrieren Extensions via:
-//   r.extendsRegistrar(EXT_USER_DATA, { hooks: { ... } });
-//
-// Andere Features haengen sich ein via:
-//   r.useExtension(EXT_USER_DATA, "myEntity", { ...hookImpls });
-//
-// Hintergrund: Magic-Strings driften zwischen Bundled-Features (Beispiel:
-// text-content nutzt "Admin" als Rolle, tenant-handler nutzt "TenantAdmin").
-// Constants sind die einzige Quelle der Wahrheit; String-Literale werden
-// in den Sprint-Touchpoints schrittweise ersetzt. Boot-Validator
-// (validateExtensionUsages) checkt dass jedes useExtension einen
-// passenden extendsRegistrar findet — Tippfehler in Constants →
-// Compile-Time-Fail.
-//
-// Hook-Signaturen + Boot-Validation pro Extension-Achse kommen mit dem
-// jeweiligen registrierenden Sprint:
-//   userData / tenantData         → Sprint 2 (user-data-rights, retention)
-//   storageProvider                → Sprint 4 (storage-encryption)
-//   searchAdapter / external /     → Sprint 5 (tenant-lifecycle)
-//   infraResource
-
-/**
- * `userData` — User-Daten-Rights-Hooks (DSGVO Art. 15 + 17 + 20).
- *
- * Erwartete Hook-Methoden:
- *   - `export(userId, ctx) => Promise<UserDataExport>`
- *   - `delete(userId, strategy: "delete" | "anonymize", ctx) => Promise<void>`
- *
- * Registriert von: `user-data-rights` (Sprint 2).
- * Genutzt von: jedes Feature mit User-Referenzen (tasks, comments, files, ...).
- */
-export const EXT_USER_DATA = "userData" as const;
-
-// Order-Bänder für EXT_USER_DATA-Hooks (forget-Pipeline). Der Kontrakt war
-// implizit über zwei Packages verteilt (-100 in custom-fields, 0 in
-// user-data-rights) — ein Host-Hook mit order < REDACT_BEFORE_OWNER liefe
-// VOR den Redaktoren und brächte den Strip-nach-owner-null-Bug zurück
-// (DSGVO-Art.-17-Regression). Regel: Redaktoren < 0 <= owner-mutierende Hooks.
-export const EXT_USER_DATA_ORDER = {
-  REDACT_BEFORE_OWNER: -100,
-  DEFAULT: 0,
-} as const;
-
-/**
- * `tenantData` — Tenant-Destroy-Hooks pro Entity (DSGVO + AVV-Beendigung).
- *
- * Erwartete Hook-Methoden:
- *   - `destroy(tenantId, ctx) => Promise<void>`
- *
- * Registriert von: `tenant-lifecycle` (Sprint 5).
- * Genutzt von: jedes Feature mit tenantId-Field.
- */
-export const EXT_TENANT_DATA = "tenantData" as const;
-
-/**
- * `storageProvider` — file-storage-plugin tenant-destroy hook.
- *
- * Expected hook method: `destroyTenant(tenantId, ctx) => Promise<void>`.
- *
- * Registered by: `files-tenant-data`.
- * Consumed by: pluggable providers (Local, MinIO, S3, R2).
- */
-export const EXT_STORAGE_PROVIDER = "storageProvider" as const;
-
-/**
- * `fileProvider` — File-Storage-Provider-Plugin-Selection (file-foundation).
- *
- * Provider-Features (file-provider-s3, -inmemory, -s3-env) registrieren eine
- * Implementierung via `r.useExtension(EXT_FILE_PROVIDER, "<name>", { build })`;
- * der per-Tenant Config-Key `provider` waehlt zur Runtime eine aus. Der
- * Framework-Resolver (`createFileProviderForTenant`) liest das, damit Upload-
- * Routes, `ctx.files` UND die DSGVO-Jobs denselben Store treffen.
- *
- * Framework-seitig besessen, damit kein String-Drift entsteht — file-
- * foundation MUSS Extension-Point + Config-Key unter genau diesen Namen
- * registrieren.
- */
-export const EXT_FILE_PROVIDER = "fileProvider" as const;
-
-// Qualifizierter Config-Key, den das file-foundation-Feature registriert
-// (Format `<feature>:config:<key>`). Akzeptierte Kopplung: der Framework-
-// Resolver liegt UNTER dem Feature und liest den Key per String. Umbenennen
-// des file-foundation-Features MUSS diese Konstante mitziehen.
-export const FILE_PROVIDER_CONFIG_KEY = "file-foundation:config:provider" as const;
-
-// Two roles: boot gate (validateBoot requires its presence once file/image
-// fields are in use) AND the ENV source of the config key above, bridged via
-// keyDef.env. Tenant rows keep overriding the bridged value.
-export const FILE_STORAGE_PROVIDER_ENV = "FILE_STORAGE_PROVIDER" as const;
-
-// Presence placeholder runDevApp writes when an explicitly wired provider
-// (options.files) already satisfies the boot gate. It names no plugin, so
-// provider resolution treats it like an unset key.
-export const FILE_STORAGE_PROVIDER_BOOT_SENTINEL = "configured" as const;
-
-/**
- * `derivativeRenderer` — File-Derivative-Renderer-Plugin-Selection
- * (file-derivatives).
- *
- * Renderer-Features (a future `derivatives-*` feature) register via
- * `r.useExtension(EXT_DERIVATIVE_RENDERER, "<mimePattern>", { render })`,
- * where `<mimePattern>` is an exact MIME type (`application/pdf`) or a
- * type-wildcard (`image/*`). `ctx.derivatives.variant(...)` resolves the
- * renderer for a FileRef's MIME type at call time — exact match first,
- * wildcard second.
- *
- * No `r.extensionSelector` and no config key: unlike `fileProvider`, the
- * resolution is deterministic from the MIME type — no tenant ever picks a
- * different image library for the same content type.
- */
-export const EXT_DERIVATIVE_RENDERER = "derivativeRenderer" as const;
-
-/**
- * `derivativePublicPredicate` — per-entityType "is this FileRef's derivative
- * publicly readable?" gate for the anonymous variant route (file-derivatives).
- *
- * Apps register via
- * `r.useExtension(EXT_DERIVATIVE_PUBLIC_PREDICATE, "<entityType>", { isPublic:
- * (args, ctx) => boolean | Promise<boolean> })`, where `<entityType>` is the
- * `entityType` string a FileRef carries from upload (e.g. "vehicle", "event").
- * No registration for a given entityType is default-deny — the public route
- * serves nothing for that entityType, not even a 403 (404, so existence isn't
- * confirmed to an unauthorised caller).
- *
- * Registered/consumed by: `file-derivatives`' public variant route (#1951).
- */
-export const EXT_DERIVATIVE_PUBLIC_PREDICATE = "derivativePublicPredicate" as const;
-
-/**
- * `derivativeOverlayResolver` — per-entityType "resolve this overlay
- * dataToken to its real value" contract for `file-derivatives`' overlay
- * compositing (QR codes on a public variant).
- *
- * Apps register via `r.useExtension(EXT_DERIVATIVE_OVERLAY_RESOLVER,
- * "<entityType>", { resolve: (args) => string | Promise<string> })`. Missing
- * registration, or a resolve() returning an empty string, both throw —
- * unlike `derivativePublicPredicate`, there is no default-deny answer here:
- * an image silently rendered without its QR would look correct while being
- * wrong.
- *
- * Registered/consumed by: `file-derivatives`'s `variant()`
- * (derivatives-context.ts), before the variant's spec hash is computed.
- */
-export const EXT_DERIVATIVE_OVERLAY_RESOLVER = "derivativeOverlayResolver" as const;
-
-/**
- * `searchAdapter` — search-index tenant-destroy hook (Meilisearch index
- * cleanup on tenant-destroy).
- *
- * Expected hook method: `destroyTenant(tenantId, ctx) => Promise<void>`.
- *
- * Consumed by: Meilisearch and other search-adapter implementations.
- */
-export const EXT_SEARCH_ADAPTER = "searchAdapter" as const;
-
-/**
- * `externalResource` — external-service tenant-destroy hook (webhook
- * subscriptions, Brevo recipient lists, provider customer accounts).
- *
- * Expected hook method: `destroyTenant(tenantId, ctx) => Promise<void>`.
- */
-export const EXT_EXTERNAL_RESOURCE = "externalResource" as const;
-
-/**
- * `infraResource` — Pulumi-managed per-tenant resource tenant-destroy hook
- * (custom domain, cert-manager issuer, dedicated pod/volume).
- *
- * Expected hook method: `destroyTenant(tenantId, ctx) => Promise<void>`.
- */
-export const EXT_INFRA_RESOURCE = "infraResource" as const;
-
-/**
- * `principalStatus` — "is this principal blocked from signing in" contract,
- * consulted by the active-membership building block; fulfilled by the bundled `user` feature.
- */
-export const EXT_PRINCIPAL_STATUS = "principalStatus" as const;
-
-/**
- * `tenantLifecycleStatus` — tenant-teardown status contract, fulfilled by
- * the bundled `tenant-lifecycle` feature; absent means no tenant is ever "in teardown".
- */
-export const EXT_TENANT_LIFECYCLE_STATUS = "tenantLifecycleStatus" as const;
-
-// Default membership-list query handler name. Accepted coupling, same
-// pattern as FILE_PROVIDER_CONFIG_KEY — the `tenant` feature registers a handler under this literal.
-export const TENANT_MEMBERSHIPS_QUERY = "tenant:query:memberships" as const;
-
-/**
- * Union aller standardisierten Extension-Namen der Datenschutz-Surface.
- * Nicht alle Extensions im System sind in dieser Liste — andere
- * Features koennen weiterhin eigene Extension-Namen registrieren.
- */
-export type KumikoExtensionName =
-  | typeof EXT_USER_DATA
-  | typeof EXT_TENANT_DATA
-  | typeof EXT_STORAGE_PROVIDER
-  | typeof EXT_SEARCH_ADAPTER
-  | typeof EXT_EXTERNAL_RESOURCE
-  | typeof EXT_INFRA_RESOURCE
-  | typeof EXT_FILE_PROVIDER
-  | typeof EXT_DERIVATIVE_RENDERER
-  | typeof EXT_DERIVATIVE_PUBLIC_PREDICATE
-  | typeof EXT_DERIVATIVE_OVERLAY_RESOLVER
-  | typeof EXT_PRINCIPAL_STATUS
-  | typeof EXT_TENANT_LIFECYCLE_STATUS;
-
-/** The four `destroyTenant(tenantId, ctx)`-only resource-cleanup extension points. */
-export type TenantResourceExtensionName =
-  | typeof EXT_STORAGE_PROVIDER
-  | typeof EXT_SEARCH_ADAPTER
-  | typeof EXT_EXTERNAL_RESOURCE
-  | typeof EXT_INFRA_RESOURCE;
-
-// r.useExtension options-shape for framework-owned extension points; app/bundled-features-owned
-// points augment co-located with their owner, since the framework never imports upward.
-declare module "@cosmicdrift/kumiko-framework/engine" {
-  interface KumikoExtensionOptionsMap {
-    [EXT_TENANT_DATA]: TenantDataExtensionHooks;
-    [EXT_USER_DATA]: UserDataExtensionOptions;
-    [EXT_FILE_PROVIDER]: FileProviderPlugin;
-    [EXT_DERIVATIVE_RENDERER]: DerivativeRendererPlugin;
-    [EXT_DERIVATIVE_OVERLAY_RESOLVER]: OverlayResolverPlugin;
-    [EXT_PRINCIPAL_STATUS]: PrincipalStatusPlugin;
-    [EXT_TENANT_LIFECYCLE_STATUS]: TenantLifecycleStatusPlugin;
-    [EXT_STORAGE_PROVIDER]: TenantResourceExtensionHooks;
-    [EXT_SEARCH_ADAPTER]: TenantResourceExtensionHooks;
-    [EXT_EXTERNAL_RESOURCE]: TenantResourceExtensionHooks;
-    [EXT_INFRA_RESOURCE]: TenantResourceExtensionHooks;
-    [TENANT_TIER_RESOLVER_EXT]: TierResolverPlugin;
-  }
-}

package/src/engine/extension-selector-plugins.ts

@@ -1,24 +0,0 @@
-import type { Registry } from "./types/feature";
-
-// Pinned QN of config's selected-extensions query — framework cannot import
-// bundled-features, so a pin test bundled-side keeps it equal to the handler.
-export const SELECTED_EXTENSIONS_QUERY = "config:query:config-value:selected-extensions";
-
-export const EXTENSION_SELECTOR_HINT_KEY = "config.settings.extensionSelectorHint";
-
-export function selectablePluginIds(
-  registry: Pick<Registry, "getExtensionUsages">,
-  extensionName: string,
-): string[] {
-  return [...new Set(registry.getExtensionUsages(extensionName).map((u) => u.entityName))].sort();
-}
-
-export function extensionSelectorTargets(
-  registry: Pick<Registry, "getAllExtensionSelectors">,
-): ReadonlyMap<string, string> {
-  const extensionByKey = new Map<string, string>();
-  for (const [extensionName, selectorKey] of registry.getAllExtensionSelectors()) {
-    extensionByKey.set(selectorKey, extensionName);
-  }
-  return extensionByKey;
-}

package/src/engine/extensions/__tests__/hook-ctx-db-tenant-scoped.test.ts

@@ -1,76 +0,0 @@
-// fw#2914 — TenantDataHookCtx.db / UserDataHookCtx.db are TenantDb, not a raw
-// DbRunner. A hook that hasn't declared `escapeHatch: { reason }` on its
-// `r.useExtension(...)` registration must not be able to reach raw SQL
-// through `ctx.db` at all — these are compile-time guarantees, not runtime
-// checks (the runtime denial is covered by escape-hatch-declaration
-// .integration.test.ts in bundled-features/user-data-rights).
-
-import { describe, expect, test } from "bun:test";
-import type { DbRunner } from "@cosmicdrift/kumiko-types/db-connection";
-import { createTenantDb } from "../../../db/tenant-db";
-import { testTenantId } from "../../../stack";
-import type { TenantDataHookCtx } from "../tenant-data";
-import type { UserDataHookCtx } from "../user-data";
-
-const tenantId = testTenantId(1);
-
-function fakeRunner(): DbRunner {
-  return {
-    unsafe: async () => [],
-    begin: async () => {
-      throw new Error("begin not used in this test");
-    },
-  } as unknown as DbRunner;
-}
-
-describe("TenantDataHookCtx.db / UserDataHookCtx.db are TenantDb, not DbRunner", () => {
-  test("compile-time: ctx.db has no raw .unsafe()/.begin() surface", () => {
-    const tenantCtx: TenantDataHookCtx = {
-      db: createTenantDb(fakeRunner(), tenantId),
-      registry: {} as TenantDataHookCtx["registry"],
-      tenantId,
-    };
-    const userCtx: UserDataHookCtx = {
-      db: createTenantDb(fakeRunner(), tenantId),
-      registry: {} as UserDataHookCtx["registry"],
-      tenantId,
-      userId: "user-1",
-    };
-
-    // @ts-expect-error TenantDb has no `.unsafe()` — only DbRunner does.
-    expect(tenantCtx.db.unsafe).toBeUndefined();
-    // @ts-expect-error TenantDb has no `.begin()` — only DbRunner does.
-    expect(tenantCtx.db.begin).toBeUndefined();
-    // @ts-expect-error TenantDb has no `.unsafe()` — only DbRunner does.
-    expect(userCtx.db.unsafe).toBeUndefined();
-    // @ts-expect-error TenantDb has no `.begin()` — only DbRunner does.
-    expect(userCtx.db.begin).toBeUndefined();
-  });
-
-  test("compile-time: ctx.db does not structurally satisfy DbRunner", () => {
-    const tenantCtx: TenantDataHookCtx = {
-      db: createTenantDb(fakeRunner(), tenantId),
-      registry: {} as TenantDataHookCtx["registry"],
-      tenantId,
-    };
-
-    // @ts-expect-error TenantDb is not assignable to DbRunner — a hook can't
-    // smuggle ctx.db into a helper typed to expect a raw connection.
-    const asRunner: DbRunner = tenantCtx.db;
-    expect(asRunner).toBeDefined();
-  });
-
-  test("declared escape hatch: ctx.db.unsafeRaw(reason) returns a real DbRunner", () => {
-    const runner = fakeRunner();
-    const tenantCtx: TenantDataHookCtx = {
-      db: createTenantDb(runner, tenantId, "tenant", undefined, undefined, undefined, {
-        unsafeRaw: { reason: "test: declared escape hatch" },
-      }),
-      registry: {} as TenantDataHookCtx["registry"],
-      tenantId,
-    };
-
-    const raw: DbRunner = tenantCtx.db.unsafeRaw("test: declared escape hatch");
-    expect(raw).toBe(runner);
-  });
-});

package/src/engine/extensions/escape-hatch-usage.ts

@@ -1,16 +0,0 @@
-// fw#2914 — reads the { escapeHatch: { reason } } convention off a
-// `r.useExtension(...)` registration's untyped options bag. Registration-time
-// validation (feature-ui-extensions.ts's useExtension) already rejects an
-// empty reason, but options stays `Record<string, unknown>`, so orchestrators
-// re-narrow at read time instead of trusting the shape.
-
-import type { RegistrarExtensionRegistration } from "../types/config";
-
-export function extensionUsageEscapeHatchReason(
-  usage: Pick<RegistrarExtensionRegistration, "options">,
-): string | undefined {
-  const escapeHatch = usage.options?.["escapeHatch"];
-  if (typeof escapeHatch !== "object" || escapeHatch === null) return undefined;
-  const reason = (escapeHatch as { reason?: unknown }).reason;
-  return typeof reason === "string" && reason.trim().length > 0 ? reason : undefined;
-}

package/src/engine/extensions/storage-provider.ts

@@ -1,16 +0,0 @@
-// EXT_STORAGE_PROVIDER (tenant-destroy binary cleanup) is one of the four
-// EXT_*_RESOURCE-style extension points — see tenant-resource.ts for the
-// shared hook-signature contract. Kept as aliases so the existing public
-// exports/imports stay valid; a hook that needs a plain cross-tenant read
-// (kumiko-framework#3035: does a foreign tenant's file_refs row still
-// reference a key under THIS tenant's storage prefix) uses `db` directly via
-// executeRawQueryRead — there is no `ctx.systemDb` here.
-import type {
-  TenantResourceDestroyHook,
-  TenantResourceExtensionHooks,
-  TenantResourceHookCtx,
-} from "./tenant-resource";
-
-export type StorageProviderHookCtx = TenantResourceHookCtx;
-export type StorageProviderDestroyTenantHook = TenantResourceDestroyHook;
-export type StorageProviderExtensionHooks = TenantResourceExtensionHooks;

package/src/engine/extensions/tenant-data.ts

@@ -1,34 +0,0 @@
-// Hook-Signatur-Types für EXT_TENANT_DATA (DSGVO tenant-scoped destroy).
-//
-// Mirror of engine/extensions/user-data.ts at tenant granularity.
-// tenant-lifecycle orchestrates destroy via registry.getExtensionUsages(EXT_TENANT_DATA).
-
-import type { FileProviderResolver } from "@cosmicdrift/kumiko-types/file-provider-resolver-types";
-import type { TenantDb } from "../../db/tenant-db";
-import type { Registry, TenantId } from "../types";
-
-// fw#2914 — db is tenant-filtered; unfiltered access needs
-// `escapeHatch: { reason }` on the owning `r.useExtension(...)` registration.
-export interface TenantDataHookCtx {
-  readonly db: TenantDb;
-  readonly registry: Registry;
-  readonly tenantId: TenantId;
-  // Threaded through from DestructionStageCtx (tenant-lifecycle/stages.ts),
-  // which resolves it unconditionally for every stage. "app-data" is the
-  // only stage where a fileRef row still exists to read a storageKey off —
-  // the "files" stage's prefix sweep runs after this stage already purged
-  // the rows (kumiko-framework#3035). Undefined when no file-provider is
-  // wired; a hook that needs it must treat that as "nothing to clean up".
-  readonly fileProviderResolver?: FileProviderResolver;
-  readonly log?: (message: string) => void;
-}
-
-export type TenantDataDestroyHook = (ctx: TenantDataHookCtx) => Promise<void>;
-
-export interface TenantDataExtensionHooks {
-  readonly destroy: TenantDataDestroyHook;
-}
-
-export function isTenantDataExtensionHooks(o: unknown): o is TenantDataExtensionHooks {
-  return typeof o === "object" && o !== null && "destroy" in o && typeof o.destroy === "function";
-}

package/src/engine/extensions/tenant-resource.ts

@@ -1,40 +0,0 @@
-// Hook signature types shared by the four EXT_*_RESOURCE-style extension
-// points (storageProvider, searchAdapter, externalResource, infraResource).
-// runExtensionDestroyHooks (tenant-lifecycle/stages.ts) passes tenantId as
-// its own positional arg for all of them, not just storageProvider — the
-// stage runner's DestructionStageCtx is a structural superset of the ctx
-// below, so a hook typed against it is safely assignable wherever the
-// richer ctx is passed.
-//
-// `db` is a raw DbRunner, not a tenant-scoped TenantDb: wiping a whole
-// search index, an S3 prefix, or infra resources is inherently a
-// cross-tenant, bulk operation, not a row-scoped one — there is no
-// escapeHatch/unsafeRaw gate here because nothing ever wraps `db`.
-import type { FileProviderResolver } from "@cosmicdrift/kumiko-types/file-provider-resolver-types";
-import type { DbRunner } from "../../db/connection";
-import type { TenantId } from "../types";
-
-export interface TenantResourceHookCtx {
-  readonly tenantId: TenantId;
-  readonly db: DbRunner;
-  readonly fileProviderResolver?: FileProviderResolver;
-  readonly log?: (message: string) => void;
-}
-
-export type TenantResourceDestroyHook = (
-  tenantId: TenantId,
-  ctx: TenantResourceHookCtx,
-) => Promise<void>;
-
-export interface TenantResourceExtensionHooks {
-  readonly destroyTenant: TenantResourceDestroyHook;
-}
-
-export function isTenantResourceExtensionHooks(o: unknown): o is TenantResourceExtensionHooks {
-  return (
-    typeof o === "object" &&
-    o !== null &&
-    "destroyTenant" in o &&
-    typeof o.destroyTenant === "function"
-  );
-}