@cosmicdrift/kumiko-bundled-features 0.105.2 → 0.108.0

package/src/personal-access-tokens/handlers/revoke.write.ts

@@ -0,0 +1,37 @@
+import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { Temporal } from "temporal-polyfill";
+import { z } from "zod";
+import { PatErrors } from "../constants";
+import { apiTokenTable } from "../schema/api-token";
+
+// Revoke one of the caller's own tokens. Ownership is enforced in the WHERE
+// (userId = caller), so a caller can't revoke another user's token and a miss
+// is a uniform ownership error with no existence oracle. isNull(revokedAt)
+// keeps a double-revoke from overwriting the original timestamp.
+export const revokePatWrite = defineWriteHandler({
+  name: "revoke",
+  schema: z.object({ id: z.uuid() }),
+  access: { openToAll: true },
+  handler: async (event, ctx) => {
+    const updated = await updateMany(
+      ctx.db,
+      apiTokenTable,
+      { revokedAt: Temporal.Now.instant() },
+      { id: event.payload.id, userId: event.user.id, revokedAt: null },
+    );
+    if (updated.length > 0) return { isSuccess: true, data: { id: event.payload.id } };
+    return writeFailure(
+      new UnprocessableError(PatErrors.ownershipDenied, {
+        i18nKey: "errors.ownershipDenied",
+        details: {
+          scope: "entity",
+          entityName: "api-token",
+          action: "revoke",
+          userId: event.user.id,
+        },
+      }),
+    );
+  },
+});

package/src/personal-access-tokens/hash.ts

@@ -0,0 +1,17 @@
+import { createHash } from "node:crypto";
+import { generateToken, PAT_TOKEN_PREFIX } from "@cosmicdrift/kumiko-framework/api";
+import { PAT_PREFIX_DISPLAY_LENGTH } from "./constants";
+
+// A PAT is high-entropy (32 random bytes from generateToken). A single SHA-256
+// is the right hash here: fast on the per-request auth path, and there's no
+// brute-force surface that would justify argon2 (that's for low-entropy
+// passwords). Only the hash is persisted — the plaintext exists once, in the
+// create response.
+export function hashPatToken(rawToken: string): string {
+  return createHash("sha256").update(rawToken).digest("hex");
+}
+
+export function mintPatToken(): { raw: string; hash: string; prefix: string } {
+  const raw = `${PAT_TOKEN_PREFIX}${generateToken()}`;
+  return { raw, hash: hashPatToken(raw), prefix: raw.slice(0, PAT_PREFIX_DISPLAY_LENGTH) };
+}

package/src/personal-access-tokens/index.ts

@@ -0,0 +1,45 @@
+import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { PAT_DEFAULT_RATE_LIMIT, type PatRateLimit } from "./constants";
+import type { PatScopeConfig } from "./scopes";
+
+export type { PatRateLimit } from "./constants";
+export { PAT_DEFAULT_RATE_LIMIT, PAT_FEATURE, PatHandlers, PatQueries } from "./constants";
+export type { PersonalAccessTokensOptions } from "./feature";
+export { createPersonalAccessTokensFeature } from "./feature";
+export { hashPatToken, mintPatToken } from "./hash";
+export { createPatResolver } from "./resolver";
+export { apiTokenEntity, apiTokenTable } from "./schema/api-token";
+export type { PatScopeConfig, PatScopeDef } from "./scopes";
+export { expandScopes } from "./scopes";
+
+// Reads the scope catalog off a mounted PAT feature's exports (set from the
+// setup-callback return). run-prod-app uses this to build the resolver from the
+// same config the handlers were given. Returns {} for a non-PAT / malformed
+// definition — the caller has already matched on feature.name.
+export function patScopesFromFeature(feature: FeatureDefinition): PatScopeConfig {
+  const exports = feature.exports;
+  if (exports && typeof exports === "object" && "scopes" in exports) {
+    const { scopes } = exports as { scopes: unknown };
+    if (scopes && typeof scopes === "object") return scopes as PatScopeConfig;
+  }
+  return {};
+}
+
+// Reads the per-token rate-limit config off a mounted PAT feature's exports.
+// Falls back to the default when absent. run-prod-app uses this to build the
+// limiter from the same declaration the feature was given.
+export function patRateLimitFromFeature(feature: FeatureDefinition): PatRateLimit {
+  const exports = feature.exports;
+  if (exports && typeof exports === "object" && "rateLimit" in exports) {
+    const { rateLimit } = exports as { rateLimit: unknown };
+    if (
+      rateLimit &&
+      typeof rateLimit === "object" &&
+      "maxRequests" in rateLimit &&
+      "windowMs" in rateLimit
+    ) {
+      return rateLimit as PatRateLimit;
+    }
+  }
+  return PAT_DEFAULT_RATE_LIMIT;
+}

package/src/personal-access-tokens/resolver.ts

@@ -0,0 +1,58 @@
+import type { PatResolver } from "@cosmicdrift/kumiko-framework/api";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { Temporal } from "temporal-polyfill";
+import { hashPatToken } from "./hash";
+import { resolvePatRoles } from "./roles";
+import { apiTokenTable } from "./schema/api-token";
+import { expandScopes, type PatScopeConfig } from "./scopes";
+
+// Hot-path resolver — raw-DB like session-callbacks (a dispatcher roundtrip on
+// every request buys nothing here). Hash the bearer token, point-read the row,
+// reject revoked/expired, resolve LIVE roles, expand granted scopes into
+// allowedQns. Any failure returns null so the middleware answers a uniform 401
+// with no oracle about which check failed.
+export function createPatResolver(opts: {
+  readonly db: DbConnection;
+  readonly scopes: PatScopeConfig;
+}): PatResolver {
+  const { db, scopes } = opts;
+  return async (rawToken: string): Promise<SessionUser | null> => {
+    const row = await fetchOne<{
+      id: string;
+      userId: string;
+      tenantId: string;
+      scopes: string;
+      revokedAt: unknown;
+      expiresAt: { epochMilliseconds: number } | null;
+    }>(db, apiTokenTable, { tokenHash: hashPatToken(rawToken) });
+    if (!row) return null;
+    if (row.revokedAt !== null) return null;
+    if (
+      row.expiresAt &&
+      row.expiresAt.epochMilliseconds <= Temporal.Now.instant().epochMilliseconds
+    ) {
+      return null;
+    }
+    const roles = await resolvePatRoles(db, row.userId, row.tenantId);
+    if (!roles) return null;
+    const granted = parseScopeNames(row.scopes);
+    return {
+      id: row.userId,
+      // @cast-boundary db-row → branded id: stored from a valid SessionUser.tenantId at create
+      tenantId: row.tenantId as TenantId,
+      roles,
+      pat: { tokenId: row.id, scopes: granted, allowedQns: expandScopes(scopes, granted) },
+    };
+  };
+}
+
+function parseScopeNames(raw: string): string[] {
+  try {
+    const parsed: unknown = JSON.parse(raw);
+    return Array.isArray(parsed) ? parsed.filter((s): s is string => typeof s === "string") : [];
+  } catch {
+    return [];
+  }
+}

package/src/personal-access-tokens/roles.ts

@@ -0,0 +1,29 @@
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { stripForbiddenMembershipRoles } from "@cosmicdrift/kumiko-framework/engine";
+import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
+import { tenantMembershipsTable } from "../tenant";
+import { userTable } from "../user";
+
+// Live role resolution for a (userId, tenantId), mirroring login.write.ts:
+// global roles (users.roles) ∪ tenant-membership roles (forbidden roles
+// stripped). Resolved fresh on every PAT request — a snapshot baked at mint
+// time would keep a since-revoked admin role for the token's whole (months-long)
+// life. Returns null when the user has no membership in that tenant: removed
+// from the tenant → the PAT stops authenticating there.
+export async function resolvePatRoles(
+  db: DbConnection,
+  userId: string,
+  tenantId: string,
+): Promise<readonly string[] | null> {
+  const memberships = await selectMany<{ roles: string }>(db, tenantMembershipsTable, {
+    userId,
+    tenantId,
+  });
+  const membership = memberships[0];
+  if (!membership) return null;
+  const userRow = await fetchOne<{ roles: string | null }>(db, userTable, { id: userId });
+  const globalRoles = parseRoles(userRow?.roles ?? null);
+  const membershipRoles = stripForbiddenMembershipRoles(parseRoles(membership.roles));
+  return [...new Set([...globalRoles, ...membershipRoles])];
+}

package/src/personal-access-tokens/schema/api-token.ts

@@ -0,0 +1,56 @@
+import { buildEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
+import {
+  access,
+  createEntity,
+  createTextField,
+  createTimestampField,
+} from "@cosmicdrift/kumiko-framework/engine";
+
+// One row per Personal Access Token. Like read_user_sessions this is a
+// direct-write store (r.unmanagedTable): the create/revoke handlers write it and
+// the resolver point-reads it on the hot auth path. `tokenHash` is the SHA-256
+// of the plaintext (never the plaintext); the unique index on it makes the
+// resolver a single point-read. All columns are privileged-write so no user
+// request can forge ownership/scope/hash by poking a field directly — the
+// handlers mutate them via ctx.db inside the pipeline.
+export const apiTokenEntity = createEntity({
+  table: "read_api_tokens",
+  // No softDelete: revocation is its own lifecycle (revokedAt timestamp), and
+  // we keep revoked rows for the "your tokens" audit list.
+  softDelete: false,
+  fields: {
+    userId: createTextField({
+      required: true,
+      maxLength: 36,
+      access: { write: access.privileged },
+    }),
+    tenantId: createTextField({
+      required: true,
+      maxLength: 36,
+      access: { write: access.privileged },
+    }),
+    name: createTextField({ required: true, maxLength: 120, access: { write: access.privileged } }),
+    tokenHash: createTextField({
+      required: true,
+      maxLength: 64,
+      access: { write: access.privileged },
+    }),
+    prefix: createTextField({
+      required: true,
+      maxLength: 16,
+      access: { write: access.privileged },
+    }),
+    // JSON-encoded string[] of granted scope names — mirrors the roles-column
+    // convention (parseRoles-style text); the resolver JSON.parses it.
+    scopes: createTextField({ required: true, access: { write: access.privileged } }),
+    createdAt: createTimestampField({ required: true, access: { write: access.privileged } }),
+    expiresAt: createTimestampField({ access: { write: access.privileged } }),
+    revokedAt: createTimestampField({ access: { write: access.privileged } }),
+  },
+  indexes: [{ unique: true, columns: ["tokenHash"], name: "read_api_tokens_hash_unique" }],
+});
+
+// buildEntityTableMeta (not buildEntityTable): this is a direct-write store, so
+// the table must be a WritableTable (post ES-write-brand #742) — same as
+// sessions' userSessionTable. buildEntityTable is branded executor-only.
+export const apiTokenTable = buildEntityTableMeta("api-token", apiTokenEntity);

package/src/personal-access-tokens/scopes.ts

@@ -0,0 +1,22 @@
+// App-declared scopes. Each scope is a named bundle of QN globs the app author
+// wires when mounting the feature — a scope may span features (e.g. a "miete"
+// scope granting ledger + folders QNs). The token stores granted scope NAMES;
+// the resolver expands them to globs at request time.
+export type PatScopeDef = {
+  readonly label: string;
+  readonly qns: readonly string[];
+};
+
+export type PatScopeConfig = Readonly<Record<string, PatScopeDef>>;
+
+// Expand granted scope names into the union of their QN globs. Unknown names
+// (scope dropped from config after a token was minted) contribute nothing —
+// fail-closed: the token silently loses that capability rather than erroring.
+export function expandScopes(config: PatScopeConfig, granted: readonly string[]): string[] {
+  const out = new Set<string>();
+  for (const name of granted) {
+    const def = config[name];
+    if (def) for (const qn of def.qns) out.add(qn);
+  }
+  return [...out];
+}

package/src/personal-access-tokens/web/client-plugin.tsx

@@ -0,0 +1,29 @@
+// @runtime client
+// Client-feature factory for personal-access-tokens. Ships the PatTokensScreen
+// (mapped to the "api-tokens" screen id) + default translations. Apps mount it
+// in createKumikoApp({ clientFeatures: [personalAccessTokensClient()] }); the
+// server registers the screen dormant (r.screen) and the app places it via
+// r.nav.
+
+import { mergeTranslations, type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
+import { PAT_FEATURE, PAT_SCREEN_ID } from "../constants";
+import { defaultTranslations } from "./i18n";
+import { PatTokensScreen } from "./pat-tokens-screen";
+
+export type PersonalAccessTokensClientOptions = {
+  /** Key-wise overrides over the default bundles (de/en). */
+  readonly translations?: TranslationsByLocale;
+};
+
+export function personalAccessTokensClient(
+  options?: PersonalAccessTokensClientOptions,
+): ClientFeatureDefinition {
+  return {
+    name: PAT_FEATURE,
+    translations: mergeTranslations(defaultTranslations, options?.translations ?? {}),
+    components: {
+      [PAT_SCREEN_ID]: PatTokensScreen,
+    },
+  };
+}

package/src/personal-access-tokens/web/i18n.ts

@@ -0,0 +1,45 @@
+// @runtime client
+import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+
+export const defaultTranslations: TranslationsByLocale = {
+  de: {
+    "pat.title": "Personal Access Tokens",
+    "pat.create.title": "Neuen Token erstellen",
+    "pat.create.name": "Name",
+    "pat.create.namePlaceholder": "z. B. CLI-Automatisierung",
+    "pat.create.scopes": "Berechtigungen",
+    "pat.create.submit": "Token erstellen",
+    "pat.create.needName": "Bitte einen Namen vergeben.",
+    "pat.create.needScope": "Bitte mindestens eine Berechtigung wählen.",
+    "pat.created.title": "Token erstellt — jetzt kopieren",
+    "pat.created.hint": "Dieser Token wird nur einmal angezeigt. Kopiere ihn jetzt.",
+    "pat.created.dismiss": "Verstanden",
+    "pat.list.title": "Deine Tokens",
+    "pat.list.empty": "Noch keine Tokens.",
+    "pat.list.created": "Erstellt",
+    "pat.list.revoked": "Widerrufen",
+    "pat.list.expired": "Abgelaufen",
+    "pat.list.revoke": "Widerrufen",
+    "pat.error.generic": "Aktion fehlgeschlagen.",
+  },
+  en: {
+    "pat.title": "Personal Access Tokens",
+    "pat.create.title": "Create a new token",
+    "pat.create.name": "Name",
+    "pat.create.namePlaceholder": "e.g. CLI automation",
+    "pat.create.scopes": "Permissions",
+    "pat.create.submit": "Create token",
+    "pat.create.needName": "Please enter a name.",
+    "pat.create.needScope": "Please select at least one permission.",
+    "pat.created.title": "Token created — copy it now",
+    "pat.created.hint": "This token is shown only once. Copy it now.",
+    "pat.created.dismiss": "Got it",
+    "pat.list.title": "Your tokens",
+    "pat.list.empty": "No tokens yet.",
+    "pat.list.created": "Created",
+    "pat.list.revoked": "Revoked",
+    "pat.list.expired": "Expired",
+    "pat.list.revoke": "Revoke",
+    "pat.error.generic": "Action failed.",
+  },
+};

package/src/personal-access-tokens/web/index.ts

@@ -0,0 +1,7 @@
+// @runtime client
+export {
+  type PersonalAccessTokensClientOptions,
+  personalAccessTokensClient,
+} from "./client-plugin";
+export { defaultTranslations } from "./i18n";
+export { PatTokensScreen } from "./pat-tokens-screen";

package/src/personal-access-tokens/web/pat-tokens-screen.tsx

@@ -0,0 +1,150 @@
+// @runtime client
+// PatTokensScreen — logged-in self-service for Personal Access Tokens: mint a
+// token (name + scope toggles, plaintext shown once), list your tokens and
+// revoke them. The feature registers it dormant (r.screen); the app places it
+// via r.nav. Imports only from ../constants (pure) — no server pull-in.
+
+import {
+  useDispatcher,
+  usePrimitives,
+  useQuery,
+  useTranslation,
+} from "@cosmicdrift/kumiko-renderer";
+import { type ReactNode, useState } from "react";
+import { PatHandlers, PatQueries } from "../constants";
+
+type ScopeOption = { readonly name: string; readonly label: string };
+type TokenRow = {
+  readonly id: string;
+  readonly name: string;
+  readonly prefix: string;
+  readonly scopes: readonly string[];
+  readonly createdAt: string | null;
+  readonly expiresAt: string | null;
+  readonly revokedAt: string | null;
+};
+
+function isExpired(expiresAt: string | null): boolean {
+  return expiresAt !== null && new Date(expiresAt).getTime() <= Date.now();
+}
+
+export function PatTokensScreen(): ReactNode {
+  const t = useTranslation();
+  const { Section, Heading, Field, Input, Button, Banner, Card, Text } = usePrimitives();
+  const dispatcher = useDispatcher();
+
+  const scopesQuery = useQuery<readonly ScopeOption[]>(PatQueries.availableScopes, {});
+  const listQuery = useQuery<readonly TokenRow[]>(PatQueries.mine, {});
+
+  const [name, setName] = useState("");
+  const [selected, setSelected] = useState<readonly string[]>([]);
+  const [minted, setMinted] = useState<{ token: string; prefix: string } | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [busy, setBusy] = useState(false);
+
+  const scopes = scopesQuery.data ?? [];
+  const tokens = listQuery.data ?? [];
+
+  const toggle = (scope: string): void =>
+    setSelected((cur) => (cur.includes(scope) ? cur.filter((s) => s !== scope) : [...cur, scope]));
+
+  const create = async (): Promise<void> => {
+    if (name.trim() === "") return setError(t("pat.create.needName"));
+    if (selected.length === 0) return setError(t("pat.create.needScope"));
+    setBusy(true);
+    setError(null);
+    const res = await dispatcher.write(PatHandlers.create, {
+      name: name.trim(),
+      scopes: selected,
+    });
+    setBusy(false);
+    if (!res.isSuccess) return setError(t("pat.error.generic"));
+    const data = res.data as { token: string; prefix: string };
+    setMinted({ token: data.token, prefix: data.prefix });
+    setName("");
+    setSelected([]);
+    void listQuery.refetch?.();
+  };
+
+  const revoke = async (id: string): Promise<void> => {
+    const res = await dispatcher.write(PatHandlers.revoke, { id });
+    if (!res.isSuccess) return setError(t("pat.error.generic"));
+    void listQuery.refetch?.();
+  };
+
+  const status = (row: TokenRow): string => {
+    if (row.revokedAt !== null) return t("pat.list.revoked");
+    if (isExpired(row.expiresAt)) return t("pat.list.expired");
+    return "";
+  };
+
+  return (
+    <Section>
+      <Heading>{t("pat.title")}</Heading>
+
+      {minted && (
+        <Banner
+          variant="info"
+          actions={
+            <Button variant="secondary" onClick={() => setMinted(null)}>
+              {t("pat.created.dismiss")}
+            </Button>
+          }
+        >
+          <Heading>{t("pat.created.title")}</Heading>
+          <Text>{minted.token}</Text>
+          <Text>{t("pat.created.hint")}</Text>
+        </Banner>
+      )}
+
+      {error && <Banner variant="error">{error}</Banner>}
+
+      <Section>
+        <Heading>{t("pat.create.title")}</Heading>
+        <Field id="pat-name" label={t("pat.create.name")} required>
+          <Input
+            kind="text"
+            id="pat-name"
+            name="name"
+            value={name}
+            onChange={setName}
+            placeholder={t("pat.create.namePlaceholder")}
+            disabled={busy}
+          />
+        </Field>
+        <Text>{t("pat.create.scopes")}</Text>
+        {scopes.map((s) => (
+          <Button
+            key={s.name}
+            variant={selected.includes(s.name) ? "primary" : "secondary"}
+            onClick={() => toggle(s.name)}
+            disabled={busy}
+          >
+            {s.label}
+          </Button>
+        ))}
+        <Button type="submit" variant="primary" onClick={create} loading={busy} disabled={busy}>
+          {t("pat.create.submit")}
+        </Button>
+      </Section>
+
+      <Section>
+        <Heading>{t("pat.list.title")}</Heading>
+        {tokens.length === 0 && <Text>{t("pat.list.empty")}</Text>}
+        {tokens.map((row) => (
+          <Card key={row.id}>
+            <Text>
+              {row.name} — {row.prefix}… {status(row)}
+            </Text>
+            <Text>{row.scopes.join(", ")}</Text>
+            {row.revokedAt === null && (
+              <Button variant="danger" onClick={() => revoke(row.id)}>
+                {t("pat.list.revoke")}
+              </Button>
+            )}
+          </Card>
+        ))}
+      </Section>
+    </Section>
+  );
+}

package/src/renderer-simple/__tests__/template-resolver.integration.test.ts

@@ -1,5 +1,4 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
@@ -7,6 +6,7 @@ import {
   type TestStack,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import type { RendererContext } from "../../renderer-foundation";
 import { SYSTEM_TENANT_ID } from "../../template-resolver/constants";
 import { createTemplateResolverFeature } from "../../template-resolver/feature";
@@ -35,7 +35,7 @@ function rendererCtx(): RendererContext {
 }
 
 async function seedPlainNotificationTemplate(content: string): Promise<void> {
-  await insertOne(db, templateResourcesTable, {
+  await seedRow(db, templateResourcesTable, {
     tenantId: SYSTEM_TENANT_ID,
     slug: "welcome-mail",
     kind: "notification",

package/src/sessions/__tests__/cleanup.integration.test.ts

@@ -5,7 +5,7 @@
 // expired/revoked rows go, live rows stay, batching + signal work.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { insertOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { sql } from "@cosmicdrift/kumiko-framework/db";
 import type { AppContext } from "@cosmicdrift/kumiko-framework/engine";
 import {
@@ -14,7 +14,7 @@ import {
   testTenantId,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { resetTestTables, seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { createUserFeature } from "../../user/feature";
 import { userEntity } from "../../user/schema/user";
 import { createSessionsFeature } from "../feature";
@@ -79,7 +79,7 @@ async function seedSession(opts: {
   const past = sql`now() - ${sql.raw(`interval '${opts.ageDays} days'`)}`;
   const future = sql`now() + ${sql.raw(`interval '30 days'`)}`;
 
-  await insertOne(stack.db, userSessionTable, {
+  await seedRow(stack.db, userSessionTable, {
     id: opts.id,
     tenantId: TENANT,
     userId: opts.userId,

package/src/sessions/__tests__/rebuild-survival.integration.test.ts

@@ -1,10 +1,5 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import {
-  asRawClient,
-  insertOne,
-  selectMany,
-  updateMany,
-} from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createTenantDb, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { createRegistry, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
@@ -18,6 +13,7 @@ import {
   testTenantId,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { seedRow, updateRows } from "@cosmicdrift/kumiko-framework/testing";
 import { Temporal } from "temporal-polyfill";
 import { createUserFeature } from "../../user/feature";
 import { createSessionsFeature } from "../feature";
@@ -62,7 +58,7 @@ const SID = "00000000-0000-0000-0000-000000000001";
 
 async function insertRevokedSession(db: DbConnection): Promise<void> {
   const now = Temporal.Now.instant();
-  await insertOne(db, userSessionTable, {
+  await seedRow(db, userSessionTable, {
     id: SID,
     tenantId: TENANT,
     userId: "user-1",
@@ -71,7 +67,7 @@ async function insertRevokedSession(db: DbConnection): Promise<void> {
     ip: "1.2.3.4",
     userAgent: "test-agent",
   });
-  await updateMany(db, userSessionTable, { revokedAt: now }, { id: SID, revokedAt: null });
+  await updateRows(db, userSessionTable, { revokedAt: now }, { id: SID, revokedAt: null });
 }
 
 describe("sessions / read_user_sessions survives projection rebuild", () => {
@@ -93,6 +89,6 @@ describe("sessions / read_user_sessions survives projection rebuild", () => {
 
     const rows = await selectMany(testDb.db, userSessionTable, {});
     expect(rows.length).toBe(1);
-    expect((rows[0] as { revokedAt: unknown }).revokedAt).not.toBeNull();
+    expect(rows[0]?.revokedAt).not.toBeNull();
   });
 });