@cosmicdrift/kumiko-samples 0.362.0 → 0.363.0

package/packages/bundled-features/src/delivery/jobs.ts

@@ -16,6 +16,12 @@ import type {
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import type { JobRunner } from "@cosmicdrift/kumiko-framework/jobs";
 import * as z from "zod";
+import { fileContextForTenant } from "../file-foundation/index.js";
+import {
+  emailAttachmentRefSchema,
+  MAX_EMAIL_ATTACHMENTS,
+  toAttachmentRef,
+} from "./attachment-ref.js";
 import { appendAttemptEvent } from "./attempt-log.js";
 import { buildChannelContext } from "./channel-context.js";
 import { DeliveryJobs, deliveryIdempotencyRedisKey, deliveryPriorityRank } from "./constants.js";
@@ -49,7 +55,12 @@ const renderJobPayloadSchema = z.object({
 
 const sendJobPayloadSchema = renderJobPayloadSchema.extend({
   rendered: z
-    .object({ html: z.string(), subject: z.string(), text: z.string().optional() })
+    .object({
+      html: z.string(),
+      subject: z.string(),
+      text: z.string().optional(),
+      attachments: z.array(emailAttachmentRefSchema).max(MAX_EMAIL_ATTACHMENTS).optional(),
+    })
     .optional(),
 });
 
@@ -63,18 +74,34 @@ function requireTenantScopedDeps(
   if (!registry) throw new Error("delivery job: missing registry in job context");
   // delivery is r.systemScope()'d, so JobContext.systemDb is guaranteed; unsafeRaw
   // hands the underlying DbConnection to both — safe since they filter by tenantId themselves.
+  // Attachment lookups read only this tenant's FileRefs, plus the system tenant's for inline images.
   if (!ctx.systemDb) {
     throw new InternalError({
       message: "delivery job: ctx.systemDb missing on a system-scoped job",
     });
   }
+  // Also makes ctx.config (built for the job's tenant) the accessor of the payload tenant;
+  // job contexts carry no configFor.
   ctx.systemDb.assertTenantMatch(tenantId);
   const db = ctx.systemDb.unsafeRaw(
-    "delivery attempt append and channel context filter by this job's tenantId themselves",
+    "attempt append and channel context filter by this job's tenantId; attachment lookup reads only the job tenant's FileRefs plus, for inline images, the system tenant's",
   ) as DbConnection; // @cast-boundary db-operator — DbRunner narrows to DbConnection, jobs never run inside a DbTx
   return { db, registry };
 }
 
+function toSendRendered(
+  rendered: RenderedMessage,
+): z.infer<typeof sendJobPayloadSchema>["rendered"] {
+  return {
+    html: rendered.html,
+    subject: rendered.subject,
+    ...(rendered.text !== undefined && { text: rendered.text }),
+    ...(rendered.attachments !== undefined && {
+      attachments: rendered.attachments.map(toAttachmentRef),
+    }),
+  };
+}
+
 function resolveChannel(registry: Registry, name: string): DeliveryChannel {
   const channel = collectChannels(registry).find((c) => c.name === name);
   if (!channel) throw new Error(`delivery job: unknown channel "${name}"`);
@@ -169,7 +196,15 @@ export const deliveryRenderJob: JobHandlerFn = async (payload, ctx) => {
   const tenantId = p.tenantId as TenantId; // @cast-boundary engine-payload — stream tenant
   const { db, registry } = requireTenantScopedDeps(ctx, tenantId);
   const channel = resolveChannel(registry, p.channelName);
-  const channelCtx = buildChannelContext(db, registry, undefined, tenantId, ctx.secrets);
+  const channelCtx = buildChannelContext(
+    db,
+    registry,
+    undefined,
+    tenantId,
+    ctx.secrets,
+    ctx.config,
+    (fileTenantId) => fileContextForTenant(ctx, fileTenantId),
+  );
 
   let rendered: RenderedMessage;
   try {
@@ -184,7 +219,7 @@ export const deliveryRenderJob: JobHandlerFn = async (payload, ctx) => {
     const jobRunner = ctx["jobRunner"] as JobRunner; // @cast-boundary dynamic-key — dispatch lives on the concrete runner
     await jobRunner.dispatch(
       DeliveryJobs.send,
-      { ...p, rendered },
+      { ...p, rendered: toSendRendered(rendered) },
       { priority: deliveryPriorityRank[p.priority] },
     );
   } catch (err) {
@@ -200,7 +235,15 @@ export const deliverySendJob: JobHandlerFn = async (payload, ctx) => {
   const tenantId = p.tenantId as TenantId; // @cast-boundary engine-payload — stream tenant
   const { db, registry } = requireTenantScopedDeps(ctx, tenantId);
   const channel = resolveChannel(registry, p.channelName);
-  const channelCtx = buildChannelContext(db, registry, undefined, tenantId, ctx.secrets);
+  const channelCtx = buildChannelContext(
+    db,
+    registry,
+    undefined,
+    tenantId,
+    ctx.secrets,
+    ctx.config,
+    (fileTenantId) => fileContextForTenant(ctx, fileTenantId),
+  );
 
   try {
     const result = await channel.send(p.address, toMessage(p), channelCtx, p.rendered);

package/packages/bundled-features/src/delivery/notify-factory.ts

@@ -1,4 +1,4 @@
-import type { NotifyFactory } from "@cosmicdrift/kumiko-framework/engine";
+import type { NotifyFactory, NotifyFn, NotifyOptions } from "@cosmicdrift/kumiko-framework/engine";
 import type { DeliveryService } from "./types.js";
 
 // The same binding runProdApp wires into the app context: the calling context's
@@ -8,12 +8,17 @@ export function createDeliveryNotifyFactory(
   deliveryService: Pick<DeliveryService, "notify">,
   options: { readonly deliverQueuedInline?: boolean } = {},
 ): NotifyFactory {
-  return (user, tenantId, jobDispatcher) => (notificationType, notifyOptions) =>
-    deliveryService.notify(
-      notificationType,
-      notifyOptions,
-      user,
-      tenantId,
-      options.deliverQueuedInline === true ? undefined : jobDispatcher,
-    );
+  return (user, tenantId, jobDispatcher, deliveryDb, fileProviderResolver) => {
+    const notify: NotifyFn = (notificationType: string, notifyOptions: NotifyOptions) =>
+      deliveryService.notify(
+        notificationType,
+        notifyOptions,
+        user,
+        tenantId,
+        options.deliverQueuedInline === true ? undefined : jobDispatcher,
+        deliveryDb,
+        fileProviderResolver,
+      );
+    return notify;
+  };
 }

package/packages/bundled-features/src/delivery/testing.ts

@@ -1,6 +1,12 @@
 import type { SseBroker } from "@cosmicdrift/kumiko-framework/api";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import type { EscapeHatchAuditSink, Registry } from "@cosmicdrift/kumiko-framework/engine";
+import type {
+  ConfigAccessor,
+  EscapeHatchAuditSink,
+  Registry,
+  TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import type { FileContext } from "@cosmicdrift/kumiko-framework/files";
 import type { JobRunner } from "@cosmicdrift/kumiko-framework/jobs";
 import type { Logger } from "@cosmicdrift/kumiko-framework/logging";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
@@ -19,6 +25,8 @@ export type CreateDeliveryTestContextOptions = {
   readonly jobRunner?: JobRunner;
   readonly secrets?: SecretsContext;
   readonly idempotencyRedis?: Redis;
+  readonly filesForTenant?: (tenantId: string) => FileContext | undefined;
+  readonly tenantConfigFor?: (tenantId: TenantId) => ConfigAccessor;
 };
 
 /**

package/packages/bundled-features/src/delivery/types.ts

@@ -1,21 +1,32 @@
 import type { SseBroker } from "@cosmicdrift/kumiko-framework/api";
-import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import type { DbConnection, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type {
   DeliveryErrorCode,
   NotifyDeliveryStatus,
+  NotifyDispatched,
   NotifyJobDispatcher,
   NotifyOptions,
   NotifyPriority,
-  NotifyResult,
   Registry,
   SessionUser,
   TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
+import type { FileProviderResolver } from "@cosmicdrift/kumiko-framework/files";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
+import type { MailPayload } from "../renderer-foundation/index.js";
+import type { EmailAttachmentRef } from "./attachment-ref.js";
 import { DELIVERY_CHANNEL_EXTENSION } from "./constants.js";
 
 // --- Channel Interface ---
 
+export type RenderedMail = {
+  readonly subject: string;
+  readonly html: string;
+  readonly text: string;
+  readonly previewText?: string;
+  readonly attachments?: readonly EmailAttachmentRef[];
+};
+
 export type ChannelContext = {
   readonly db: TenantDb;
   readonly registry: Registry;
@@ -24,8 +35,19 @@ export type ChannelContext = {
   // Chat channels read their per-tenant webhook URL / bot token from it.
   // Absent when no secrets feature/KEK is wired.
   readonly secrets?: SecretsContext | undefined;
+  // Renders a stored mail template, the tenant's own or the system fallback.
+  readonly renderMail?: (payload: MailPayload) => Promise<RenderedMail>;
+  // Reads the bytes behind an attachment ref at send time. Absent when no file storage is wired.
+  readonly readAttachment?: (
+    ref: EmailAttachmentRef,
+    origin?: AttachmentOrigin,
+  ) => Promise<{ readonly content: Uint8Array; readonly contentType: string } | null>;
 };
 
+// "template": the renderer returned the ref from the stored template (own or system). "message":
+// the ref came from notify data, so a caller chose it. Unset means "message".
+export type AttachmentOrigin = "template" | "message";
+
 export type ChannelMessage = {
   readonly notificationType: string;
   readonly title: string;
@@ -49,6 +71,7 @@ export type RenderedMessage = {
   readonly html: string;
   readonly subject: string;
   readonly text?: string;
+  readonly attachments?: readonly EmailAttachmentRef[];
 };
 
 // `mode` decides how the delivery-service dispatches a channel:
@@ -76,21 +99,6 @@ export type DeliveryChannel = {
   ): Promise<ChannelResult>;
 };
 
-// --- Notification Renderer ---
-
-export type RendererInput = {
-  readonly template: string;
-  readonly variables: Readonly<Record<string, unknown>>;
-  readonly locale?: string | undefined;
-};
-
-export type NotificationRenderer = {
-  readonly name: string;
-  render(input: RendererInput): Promise<string>;
-  /** Plain-text version of the same mail; the email channel sends it as the text part of a multipart/alternative mail. */
-  renderText?(input: RendererInput): Promise<string>;
-};
-
 // --- Delivery Log Entry ---
 
 export type DeliveryLogEntry = {
@@ -114,7 +122,9 @@ export type DeliveryService = {
     user: SessionUser,
     tenantId: TenantId,
     jobDispatcher?: NotifyJobDispatcher,
-  ): Promise<NotifyResult>;
+    deliveryDb?: DbConnection,
+    fileProviderResolver?: FileProviderResolver,
+  ): Promise<NotifyDispatched>;
 };
 
 // r.useExtension options-shape: `name` is NOT part of the registration

package/packages/bundled-features/src/delivery/unsubscribe.ts

@@ -7,6 +7,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/api";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import * as jose from "jose";
 import * as z from "zod";
 import { hashUnsubscribeAddress } from "./address-opt-out.js";
@@ -412,8 +413,10 @@ function tokenFromRequestBody(request: SignatureExtraRouteVerifyRequest): string
   }
   if (contentType?.includes("application/json")) {
     try {
-      const parsed = JSON.parse(request.rawBody) as { token?: unknown };
-      return typeof parsed.token === "string" ? parsed.token : undefined;
+      const parsed: unknown = JSON.parse(request.rawBody);
+      return isPlainObject(parsed) && typeof parsed["token"] === "string"
+        ? parsed["token"]
+        : undefined;
     } catch {
       return undefined;
     }

package/packages/bundled-features/src/derivatives-sharp/render.ts

@@ -13,13 +13,10 @@ import type {
 import QRCode from "qrcode";
 import type { OverlayOptions, ResizeOptions, Sharp } from "sharp";
 import sharp from "sharp";
+import { assertNotSvg, SHARP_INPUT_OPTIONS } from "../shared/index.js";
 
 const MIN_SHARP_SIGMA = 0.3;
 const MAX_SHARP_SIGMA = 1000;
-// Above this, a decoded pixel buffer runs into hundreds of MB before any
-// resize even happens — sharp's own default (~268MP) is still large enough
-// to be an OOM primitive for a single request.
-const MAX_INPUT_PIXELS = 100_000_000;
 // Longest output edge a caller may request via `size`/`maxEdge`. Without a
 // cap, `{ maxEdge: 50000 }` allocates a multi-gigabyte buffer per encoder
 // step before any client sees a byte back.
@@ -38,12 +35,6 @@ const MAX_QR_DATA_LENGTH = 1024;
 // camera capture — the AC claims phone-scannable, so an under-sized layer
 // throws instead of caching a silently unusable image.
 const MIN_QR_PIXEL_WIDTH = 160;
-// sequentialRead trades random pixel access for lower peak memory on
-// streamed formats — applied at every decode entry point below since none
-// of them need non-sequential access to the *original* bytes (extract runs
-// against a single already-buffered region per call).
-const SHARP_INPUT_OPTIONS = { limitInputPixels: MAX_INPUT_PIXELS, sequentialRead: true } as const;
-
 function normalizeMimeType(mimeType: string): string {
   return mimeType.toLowerCase().split(";")[0]?.trim() ?? "";
 }
@@ -52,18 +43,6 @@ function clampSigma(sigma: number): number {
   return Math.min(MAX_SHARP_SIGMA, Math.max(MIN_SHARP_SIGMA, sigma));
 }
 
-// Shared trust boundary for every image byte source this renderer decodes —
-// the original upload (renderImage) and an overlay layer's bytes (applyOverlays)
-// alike: a base64 string in a field declaration isn't more trustworthy than
-// an upload just because it came from app code.
-function assertNotSvg(format: string | undefined): void {
-  if (format === "svg") {
-    throw new Error(
-      "derivatives-sharp: SVG is not supported — rendering untrusted SVG through libvips is a trust boundary this renderer doesn't need to cross.",
-    );
-  }
-}
-
 function assertValidRegion(region: BlurRegion): void {
   const values = [region.x, region.y, region.width, region.height];
   if (values.some((v) => !Number.isFinite(v)) || region.width <= 0 || region.height <= 0) {

package/packages/bundled-features/src/document-ingest-foundation/pages.ts

@@ -4,6 +4,7 @@
 // the codec here keeps liteparse + recipe consumers lockstep with the
 // entity shape (kumiko-framework#1549/1).
 
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import type { IngestPage } from "./entity.js";
 
 export function writeIngestPages(pages: readonly IngestPage[]): string {
@@ -28,7 +29,9 @@ function parseJson(raw: string): unknown {
 }
 
 function isIngestPage(value: unknown): value is IngestPage {
-  if (value === null || typeof value !== "object") return false;
-  const page = value as { pageNumber?: unknown; text?: unknown };
-  return typeof page.pageNumber === "number" && typeof page.text === "string";
+  return (
+    isPlainObject(value) &&
+    typeof value["pageNumber"] === "number" &&
+    typeof value["text"] === "string"
+  );
 }

package/packages/bundled-features/src/feature-toggles/toggle-sync-signal.ts

@@ -5,6 +5,7 @@ import {
   type RedisClientOptions,
   redisChannelPrefixFromEnv,
 } from "@cosmicdrift/kumiko-framework/redis";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import type { ToggleSyncSignal } from "./toggle-runtime.js";
 
 // Single fixed channel — unlike the SSE broker there's no per-tenant/
@@ -20,10 +21,9 @@ export type RedisToggleSyncSignal = ToggleSyncSignal & {
 
 function isTogglePayload(value: unknown): value is { featureName: string; enabled: boolean } {
   return (
-    typeof value === "object" &&
-    value !== null &&
-    typeof (value as { featureName?: unknown }).featureName === "string" &&
-    typeof (value as { enabled?: unknown }).enabled === "boolean"
+    isPlainObject(value) &&
+    typeof value["featureName"] === "string" &&
+    typeof value["enabled"] === "boolean"
   );
 }
 

package/packages/bundled-features/src/file-foundation/index.ts

@@ -7,3 +7,10 @@ export {
   fileFoundationFeature,
   isFileProviderPlugin,
 } from "./feature.js";
+export {
+  type FileRefContent,
+  FileRefTooLargeError,
+  fileContextForTenant,
+  fileContextFromResolver,
+  readFileRefContent,
+} from "./read-file-ref-content.js";

package/packages/bundled-features/src/file-foundation/read-file-ref-content.ts

@@ -0,0 +1,86 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { isUuid, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createFileContext,
+  type FileContext,
+  type FileProviderResolver,
+  fileRefsTable,
+} from "@cosmicdrift/kumiko-framework/files";
+
+export type FileRefContent = {
+  readonly content: Uint8Array;
+  readonly contentType: string;
+  readonly tenantId: string;
+  readonly size: number;
+};
+
+type FileRefRow = {
+  readonly storageKey: string;
+  readonly mimeType: string;
+  readonly tenantId: string;
+  readonly size: number | bigint | string;
+};
+
+// Tenant-bound on purpose: the FileContext of the current request only reaches its own key space.
+export function fileContextForTenant(
+  ctx: {
+    readonly _fileProviderResolver?: FileProviderResolver | undefined;
+    readonly files?: FileContext | undefined;
+  },
+  tenantId: string,
+): FileContext | undefined {
+  const resolver = ctx._fileProviderResolver;
+  if (resolver === undefined) return ctx.files;
+  return fileContextFromResolver(resolver, tenantId);
+}
+
+export function fileContextFromResolver(
+  resolver: FileProviderResolver,
+  tenantId: string,
+): FileContext {
+  // @cast-boundary engine-payload — tenantId comes from a trusted job payload or session
+  const brandedTenantId = tenantId as TenantId;
+  return createFileContext(() => resolver(brandedTenantId), tenantId);
+}
+
+export class FileRefTooLargeError extends Error {
+  constructor(readonly size: number) {
+    super(`file ref exceeds the size limit (${size} bytes)`);
+  }
+}
+
+// fileName of the row is never used: it is personal data and may be a PII ciphertext.
+export async function readFileRefContent(args: {
+  readonly db: DbRunner | TenantDb;
+  readonly filesForTenant: (tenantId: string) => FileContext | undefined;
+  readonly fileRefId: string;
+  readonly allowedTenantIds: readonly string[];
+  /** Only accept this user's own upload that is not bound to any entity yet. */
+  readonly unclaimedUploadOf?: string;
+  /** Rejects before any bytes are read when the stored size exceeds the limit. */
+  readonly maxBytes?: number;
+}): Promise<FileRefContent | null> {
+  if (!isUuid(args.fileRefId)) return null;
+  const [row] = await selectMany<FileRefRow>(args.db, fileRefsTable, {
+    id: args.fileRefId,
+    tenantId: { in: args.allowedTenantIds },
+    isDeleted: false,
+    ...(args.unclaimedUploadOf !== undefined && {
+      insertedById: args.unclaimedUploadOf,
+      entityType: null,
+      entityId: null,
+    }),
+  });
+  if (row === undefined) return null;
+  const size = Number(row.size);
+  if (args.maxBytes !== undefined && size > args.maxBytes) {
+    throw new FileRefTooLargeError(size);
+  }
+  const files = args.filesForTenant(row.tenantId);
+  if (files === undefined) {
+    throw new Error("readFileRefContent: no file storage is available for the file's tenant");
+  }
+  const content = await files.ref(row.storageKey).read();
+  return { content, contentType: row.mimeType, tenantId: row.tenantId, size };
+}

package/packages/bundled-features/src/folders/web/folder-manager.tsx

@@ -74,7 +74,10 @@ const loadCollapsed = (): ReadonlySet<string> => {
   if (typeof window === "undefined") return new Set();
   try {
     const raw = window.localStorage.getItem(COLLAPSED_KEY);
-    return new Set(raw ? (JSON.parse(raw) as string[]) : []);
+    const parsed: unknown = raw ? JSON.parse(raw) : [];
+    return new Set(
+      Array.isArray(parsed) ? parsed.filter((id): id is string => typeof id === "string") : [],
+    );
   } catch {
     return new Set();
   }
@@ -273,7 +276,7 @@ export function FolderManager({
             setDragOverKey(key);
           },
           onDragLeave: (e: DragEvent<HTMLDivElement>) => {
-            if (!e.currentTarget.contains(e.relatedTarget as Node))
+            if (!(e.relatedTarget instanceof Node && e.currentTarget.contains(e.relatedTarget)))
               setDragOverKey((cur) => (cur === key ? null : cur));
           },
           onDrop: (e: DragEvent<HTMLDivElement>) => {

package/packages/bundled-features/src/form-draft/db/queries/cleanup.ts

@@ -29,21 +29,21 @@ export async function selectStaleDraftsBatch(
   olderThanDays: number,
   batchSize: number,
 ): Promise<readonly StaleDraftRow[]> {
-  const rows = (await unsafeReadRetrying(
-    db,
-    `SELECT "id", "tenant_id", "owner_id", "draft_key", "draft", "inserted_at" FROM "read_form_drafts"
-     WHERE COALESCE("modified_at", "inserted_at") < now() - ($1::int * interval '1 day')
-     ORDER BY COALESCE("modified_at", "inserted_at") ASC
-     LIMIT $2`,
-    [olderThanDays, batchSize],
-  )) as readonly {
+  const rows = await unsafeReadRetrying<{
     id: string;
     tenant_id: string;
     owner_id: string;
     draft_key: string;
     draft: FormDraftBlob;
     inserted_at: Date;
-  }[];
+  }>(
+    db,
+    `SELECT "id", "tenant_id", "owner_id", "draft_key", "draft", "inserted_at" FROM "read_form_drafts"
+     WHERE COALESCE("modified_at", "inserted_at") < now() - ($1::int * interval '1 day')
+     ORDER BY COALESCE("modified_at", "inserted_at") ASC
+     LIMIT $2`,
+    [olderThanDays, batchSize],
+  );
   return rows.map((row) => ({
     id: row.id,
     tenantId: row.tenant_id as TenantId, // @cast-boundary db-row
@@ -61,7 +61,7 @@ export async function isDraftStillStale(
   id: string,
   olderThanDays: number,
 ): Promise<boolean> {
-  const rows = (await unsafeReadRetrying(
+  const rows = await unsafeReadRetrying<unknown>(
     db,
     `SELECT 1 FROM "read_form_drafts"
      WHERE "id" = $1
@@ -69,6 +69,6 @@ export async function isDraftStillStale(
        AND COALESCE("modified_at", "inserted_at") < now() - ($3::int * interval '1 day')
      LIMIT 1`,
     [id, tenantId, olderThanDays],
-  )) as readonly unknown[];
+  );
   return rows.length > 0;
 }

package/packages/bundled-features/src/form-draft/db/queries/draft-count.ts

@@ -11,11 +11,11 @@ export async function countDraftsByOwner(
   tenantId: TenantId,
   ownerId: string,
 ): Promise<number> {
-  const rows = (await unsafeReadRetrying(
+  const rows = await unsafeReadRetrying<{ count: number }>(
     db,
     `SELECT count(*)::int AS "count" FROM "read_form_drafts"
      WHERE "tenant_id" = $1 AND "owner_id" = $2`,
     [tenantId, ownerId],
-  )) as readonly { count: number }[];
+  );
   return rows[0]?.count ?? 0;
 }

package/packages/bundled-features/src/form-draft/db/queries/owned-file-refs.ts

@@ -62,13 +62,13 @@ export async function filterOwnedFileRefs(
   isCreateMode: boolean,
 ): Promise<readonly OwnedFileRef[]> {
   if (candidateKeys.length === 0) return [];
-  const rows = (await unsafeReadRetrying(
+  const rows = await unsafeReadRetrying<{ id: string; storage_key: string }>(
     db,
     `SELECT "id", "storage_key" FROM "file_refs"
      WHERE "tenant_id" = $1 AND "inserted_by_id" = $2
        AND "storage_key" = ANY($3::text[]) AND "is_deleted" = false
        AND ($5::boolean OR "inserted_at" > $4::timestamptz)`,
     [tenantId, ownerId, candidateKeys, draftInsertedAt.toString(), isCreateMode],
-  )) as readonly { id: string; storage_key: string }[];
+  );
   return rows.map((row) => ({ id: row.id, storageKey: row.storage_key }));
 }

package/packages/bundled-features/src/form-draft/release-file-refs.ts

@@ -1,3 +1,4 @@
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import type { FormDraftBlob } from "./schemas.js";
 
 // The draft blob's `values` is free-form by design (issue #1889: form-draft
@@ -8,8 +9,8 @@ import type { FormDraftBlob } from "./schemas.js";
 // step writes into the draft, whether under a single "file" field or nested
 // in a "files"/"images" array.
 function isFileRefPointer(value: unknown): value is { readonly storageKey: string } {
-  if (typeof value !== "object" || value === null) return false;
-  const storageKey = (value as { storageKey?: unknown }).storageKey;
+  if (!isPlainObject(value)) return false;
+  const storageKey = value["storageKey"];
   return typeof storageKey === "string" && storageKey.length > 0;
 }
 

package/packages/bundled-features/src/inbound-mail-foundation/handlers/connect-account.write.ts

@@ -95,7 +95,7 @@ export const connectAccountHandler: WriteHandlerDef = {
       authMethod: payload.authMethod,
       ownerUserId,
       displayName: payload.displayName,
-      address: encryptedFields["address"] as string,
+      address: encryptedFields.address,
       // active ab Connect — der Supervisor greift den Account beim
       // nächsten Tick auf und degradiert ihn bei Credential-Fehlern.
       status: InboundMailAccountStatuses.active,

package/packages/bundled-features/src/inbound-mail-foundation/handlers/ingest-message.write.ts

@@ -199,11 +199,11 @@ export const ingestMessageHandler: WriteHandlerDef = {
       ownerUserId: payload.ownerUserId,
       messageIdHeader: effectiveMessageIdHeader,
       threadKey,
-      from: encryptedMessageFields["from"] as string,
-      to: encryptedMessageFields["to"] as string,
-      cc: encryptedMessageFields["cc"] as string,
-      subject: encryptedMessageFields["subject"] as string,
-      snippet: encryptedMessageFields["snippet"] as string,
+      from: encryptedMessageFields.from,
+      to: encryptedMessageFields.to,
+      cc: encryptedMessageFields.cc,
+      subject: encryptedMessageFields.subject,
+      snippet: encryptedMessageFields.snippet,
       receivedAtIso: payload.receivedAtIso,
       bodyRef: payload.bodyRef,
       scope: payload.scope,
@@ -296,7 +296,7 @@ export const ingestMessageHandler: WriteHandlerDef = {
 
       const threadEventPayload: MailThreadEventPayload = {
         threadKey,
-        subject: encryptedThreadFields["subject"] as string,
+        subject: encryptedThreadFields.subject,
         lastMessageAtIso: newLastAt,
         messageCount,
       };

package/packages/bundled-features/src/inbound-mail-foundation/handlers/list-accounts.query.ts

@@ -34,7 +34,7 @@ export const listAccountsQuery: QueryHandlerDef = {
     if (!piiKms) return { rows };
     const decryptedRows = await Promise.all(
       rows.map((row) =>
-        decryptPiiFieldValues(row as Record<string, unknown>, MAIL_ACCOUNT_PII_FIELDS, piiKms, {
+        decryptPiiFieldValues(row, MAIL_ACCOUNT_PII_FIELDS, piiKms, {
           requestId: `inbound-mail-foundation:list-accounts:${ctx.user.tenantId}`,
         }),
       ),

package/packages/bundled-features/src/inbound-mail-foundation/handlers/list-messages.query.ts

@@ -49,7 +49,7 @@ export const listMessagesQuery: QueryHandlerDef = {
     if (!piiKms) return { rows };
     const decryptedRows = await Promise.all(
       rows.map((row) =>
-        decryptPiiFieldValues(row as Record<string, unknown>, INBOUND_MESSAGE_PII_FIELDS, piiKms, {
+        decryptPiiFieldValues(row, INBOUND_MESSAGE_PII_FIELDS, piiKms, {
           requestId: `inbound-mail-foundation:list-messages:${ctx.user.tenantId}`,
         }),
       ),

package/packages/bundled-features/src/inbound-mail-foundation/handlers/scope-visibility.ts

@@ -4,10 +4,10 @@
 // für read_mail_accounts und read_inbound_messages (Scope-Vererbung).
 
 export function isVisibleToCaller(
-  row: unknown,
+  row: Readonly<Record<string, unknown>>,
   user: { readonly id: string; readonly roles: readonly string[] },
 ): boolean {
-  const owner = (row as Record<string, unknown>)["ownerUserId"];
+  const owner = row["ownerUserId"];
   if (owner == null || owner === "") return true;
   if (owner === user.id) return true;
   return user.roles.includes("TenantAdmin") || user.roles.includes("SystemAdmin");