@cosmicdrift/kumiko-bundled-features 0.105.2 → 0.108.0

package/src/user/db/queries/stream-tenant-backfill.ts

@@ -0,0 +1,112 @@
+// #762 — one-time migration tooling for pre-#497 user event streams.
+//
+// #497 made `user` a systemStream entity: every executor op addresses the
+// stream on SYSTEM_TENANT_ID. Streams created before that live on whichever
+// tenant created them ("scattered"), so post-#497 writes version-conflict
+// against the empty SYSTEM stream. The raw UPDATE documented in the #497
+// changeset breaks as soon as an aggregate has BOTH a legacy stream and
+// post-#497 SYSTEM events (split stream — e.g. a skipOptimisticLock
+// lifecycle write appended v1 on SYSTEM while v1..n live on the old
+// tenant): retenanting then trips events_aggregate_version_uq.
+//
+// This tool merges per aggregate: all user events, ordered by global event
+// id, are renumbered 1..n and retenanted to SYSTEM_TENANT_ID — two-phase
+// version writes (negative interim values) dodge the unique index while the
+// per-aggregate transaction is in flight. Snapshots of migrated aggregates
+// are dropped (version numbering changed; the next snapshotting load
+// recreates them); archived-stream markers move with the stream.
+//
+// Idempotent: the candidate query only matches aggregates that still have
+// non-SYSTEM events. One failing aggregate does not abort the run — the
+// rest of the estate migrates, failures are reported.
+//
+// After a run, rebuild the user projection so read_users.tenant_id reflects
+// the stream move: rebuildProjection("user:projection:user-entity", ...) or
+// the jobs:job:projection-rebuild job.
+
+import { asRawClient, transaction } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+
+export type UserStreamBackfillResult = {
+  readonly aggregatesMigrated: number;
+  readonly eventsMigrated: number;
+  readonly failed: ReadonlyArray<{ readonly aggregateId: string; readonly error: string }>;
+};
+
+export async function backfillUserStreamTenants(
+  db: DbConnection,
+): Promise<UserStreamBackfillResult> {
+  const candidates = (await asRawClient(db).unsafe(
+    `SELECT DISTINCT "aggregate_id" FROM "kumiko_events"
+      WHERE "aggregate_type" = 'user' AND "tenant_id" <> $1::uuid`,
+    [SYSTEM_TENANT_ID],
+  )) as ReadonlyArray<{ aggregate_id: string }>;
+
+  let aggregatesMigrated = 0;
+  let eventsMigrated = 0;
+  const failed: Array<{ aggregateId: string; error: string }> = [];
+
+  for (const { aggregate_id } of candidates) {
+    try {
+      eventsMigrated += await migrateAggregate(db, aggregate_id);
+      aggregatesMigrated++;
+    } catch (e) {
+      failed.push({
+        aggregateId: aggregate_id,
+        error: e instanceof Error ? e.message : String(e),
+      });
+    }
+  }
+  return { aggregatesMigrated, eventsMigrated, failed };
+}
+
+async function migrateAggregate(db: DbConnection, aggregateId: string): Promise<number> {
+  return transaction(db, async (tx) => {
+    const raw = asRawClient(tx);
+    // Global id order = commit-adjacent replay order; merges a split stream
+    // (legacy tenant + SYSTEM) into one consistent version sequence.
+    const events = (await raw.unsafe(
+      `SELECT "id" FROM "kumiko_events"
+        WHERE "aggregate_type" = 'user' AND "aggregate_id" = $1::uuid
+        ORDER BY "id" ASC
+        FOR UPDATE`,
+      [aggregateId],
+    )) as ReadonlyArray<{ id: bigint | string }>;
+
+    // Phase 1: negative interim versions — real versions are always >= 1, so
+    // nothing can collide with events_aggregate_version_uq mid-migration.
+    for (const [i, ev] of events.entries()) {
+      await raw.unsafe(
+        `UPDATE "kumiko_events" SET "tenant_id" = $1::uuid, "version" = $2 WHERE "id" = $3`,
+        [SYSTEM_TENANT_ID, -(i + 1), ev.id],
+      );
+    }
+    // Phase 2: final contiguous 1..n.
+    for (const [i, ev] of events.entries()) {
+      await raw.unsafe(`UPDATE "kumiko_events" SET "version" = $1 WHERE "id" = $2`, [i + 1, ev.id]);
+    }
+
+    // Version numbering changed → any snapshot of this aggregate is stale.
+    await raw.unsafe(`DELETE FROM "kumiko_snapshots" WHERE "aggregate_id" = $1::uuid`, [
+      aggregateId,
+    ]);
+
+    // Archived markers key on (tenant_id, aggregate_id) — move them with the
+    // stream, keeping an existing SYSTEM marker if both exist.
+    await raw.unsafe(
+      `INSERT INTO "kumiko_archived_streams" ("tenant_id", "aggregate_id", "aggregate_type", "archived_at", "archived_by", "reason")
+        SELECT $1::uuid, "aggregate_id", "aggregate_type", "archived_at", "archived_by", "reason"
+          FROM "kumiko_archived_streams"
+         WHERE "aggregate_id" = $2::uuid AND "tenant_id" <> $1::uuid
+        ON CONFLICT DO NOTHING`,
+      [SYSTEM_TENANT_ID, aggregateId],
+    );
+    await raw.unsafe(
+      `DELETE FROM "kumiko_archived_streams" WHERE "aggregate_id" = $1::uuid AND "tenant_id" <> $2::uuid`,
+      [aggregateId, SYSTEM_TENANT_ID],
+    );
+
+    return events.length;
+  });
+}

package/src/user/index.ts

@@ -1,5 +1,9 @@
 export { UserCommandSchemas } from "./command-schemas";
 export { USER_FEATURE, UserErrors, UserHandlers, UserQueries } from "./constants";
+export {
+  backfillUserStreamTenants,
+  type UserStreamBackfillResult,
+} from "./db/queries/stream-tenant-backfill";
 export { createUserFeature } from "./feature";
 export type { UserStatus } from "./schema/user";
 export {

package/src/user-data-rights/__tests__/anonymous-deletion.integration.test.ts

@@ -6,7 +6,7 @@
 // Beweist end-to-end via echte /api/write-Calls OHNE Auth (anonymousAccess).
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { insertOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -15,7 +15,7 @@ import {
   testTenantId,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { resetTestTables, seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import {
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,
@@ -77,7 +77,7 @@ beforeEach(async () => {
 });
 
 async function seedAlice(status: string = USER_STATUS.Active, email: string = ALICE_EMAIL) {
-  await insertOne(stack.db, userTable, {
+  await seedRow(stack.db, userTable, {
     id: aliceUser.id,
     tenantId: tenantA,
     email,
@@ -343,7 +343,7 @@ describe("anonymous deletion flow — not configured (kein Secret)", () => {
     await unsafeCreateEntityTable(bareStack.db, userEntity);
     await unsafeCreateEntityTable(bareStack.db, tenantComplianceProfileEntity);
     await createEventsTable(bareStack.db);
-    await insertOne(bareStack.db, userTable, {
+    await seedRow(bareStack.db, userTable, {
       id: aliceUser.id,
       tenantId: tenantA,
       email: ALICE_EMAIL,

package/src/user-data-rights/__tests__/audit-log.integration.test.ts

@@ -1,7 +1,7 @@
 // S2.U7 — my-audit-log + invalid-attempt-audit + list-download-attempts.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { asRawClient, insertMany, insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -10,7 +10,7 @@ import {
   testTenantId,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { resetTestTables, seedRow, seedRows } from "@cosmicdrift/kumiko-framework/testing";
 import {
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,
@@ -64,7 +64,7 @@ beforeEach(async () => {
 });
 
 async function seedUser(u: typeof alice, email: string): Promise<void> {
-  await insertOne(stack.db, userTable, {
+  await seedRow(stack.db, userTable, {
     id: u.id,
     tenantId: u.tenantId,
     email,
@@ -180,7 +180,7 @@ describe("list-download-attempts (DPO operator-query)", () => {
     // Direct-INSERT in attempts (simuliert was die download-handler schreiben).
     const T = await import("@cosmicdrift/kumiko-framework/time");
     const now = T.getTemporal().Now.instant();
-    await insertMany(stack.db, downloadAttemptsTable, [
+    await seedRows(stack.db, downloadAttemptsTable, [
       {
         id: "11111111-1111-4111-8111-111111111111",
         tenantId: tenantA,

package/src/user-data-rights/__tests__/cross-data-matrix.integration.test.ts

@@ -13,7 +13,7 @@
 //     Alices Forget; Bobs Daten landen NICHT in Alices Export-Bundle.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { asRawClient, deleteMany, insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineUnmanagedTable } from "@cosmicdrift/kumiko-framework/db";
 import {
   defineFeature,
@@ -28,7 +28,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { deleteRows, resetTestTables, seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import {
   createComplianceProfilesFeature,
@@ -98,7 +98,7 @@ const exportNotes: UserDataExportHook = async (ctx) => {
 };
 
 const deleteNotes: UserDataDeleteHook = async (ctx, _strategy) => {
-  await deleteMany(ctx.db, testNotesTable, {
+  await deleteRows(ctx.db, testNotesTable, {
     tenantId: ctx.tenantId,
     authorId: ctx.userId,
   });
@@ -182,7 +182,7 @@ async function seedUser(
     displayName?: string;
   } = {},
 ): Promise<void> {
-  await insertOne(stack.db, userTable, {
+  await seedRow(stack.db, userTable, {
     id,
     tenantId: TENANT_SYSTEM,
     email: overrides.email ?? `user-${id}@example.com`,

package/src/user-data-rights/__tests__/download.integration.test.ts

@@ -9,7 +9,7 @@
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import { asRawClient, selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
@@ -25,7 +25,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { resetTestTables, updateRows } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import {
   createComplianceProfilesFeature,
@@ -302,7 +302,7 @@ describe("download-by-token :: error paths", () => {
     const longAgo = getTemporal().Instant.fromEpochMilliseconds(
       Date.now() - 365 * 24 * 60 * 60 * 1000,
     );
-    await updateMany(stack.db, exportDownloadTokensTable, { expiresAt: longAgo }, { jobId });
+    await updateRows(stack.db, exportDownloadTokensTable, { expiresAt: longAgo }, { jobId });
 
     const res = await stack.http.query(
       "user-data-rights:query:download-by-token",
@@ -316,7 +316,7 @@ describe("download-by-token :: error paths", () => {
 
   test("failed Job → 404 download.unavailable", async () => {
     const { jobId, plainToken } = await seedDoneJobWithToken();
-    await updateMany(stack.db, exportJobsTable, { status: "failed" }, { id: jobId });
+    await updateRows(stack.db, exportJobsTable, { status: "failed" }, { id: jobId });
 
     const res = await stack.http.query(
       "user-data-rights:query:download-by-token",
@@ -330,7 +330,7 @@ describe("download-by-token :: error paths", () => {
 
   test("storage cleared → 404 download.expired", async () => {
     const { jobId, plainToken } = await seedDoneJobWithToken();
-    await updateMany(stack.db, exportJobsTable, { downloadStorageKey: null }, { id: jobId });
+    await updateRows(stack.db, exportJobsTable, { downloadStorageKey: null }, { id: jobId });
 
     const res = await stack.http.query(
       "user-data-rights:query:download-by-token",
@@ -404,7 +404,7 @@ describe("download-by-job :: happy path", () => {
     // Symmetrisch zum token-Test: gleicher Code-Pfad muss auch im job-
     // handler 404 + unavailable raus, nicht 500.
     const { jobId } = await seedDoneJobWithToken();
-    await updateMany(stack.db, exportJobsTable, { status: "failed" }, { id: jobId });
+    await updateRows(stack.db, exportJobsTable, { status: "failed" }, { id: jobId });
 
     const res = await stack.http.query(
       "user-data-rights:query:download-by-job",
@@ -418,7 +418,7 @@ describe("download-by-job :: happy path", () => {
 
   test("storage cleared (downloadStorageKey null) → 404 download.expired (job-Pfad)", async () => {
     const { jobId } = await seedDoneJobWithToken();
-    await updateMany(stack.db, exportJobsTable, { downloadStorageKey: null }, { id: jobId });
+    await updateRows(stack.db, exportJobsTable, { downloadStorageKey: null }, { id: jobId });
 
     const res = await stack.http.query(
       "user-data-rights:query:download-by-job",

package/src/user-data-rights/__tests__/export-job-idempotency.integration.test.ts

@@ -10,19 +10,14 @@
 // reale Postgres + Drizzle-customType-Codec-Path braucht.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import {
-  asRawClient,
-  insertOne,
-  selectMany,
-  updateMany,
-} from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { extractPgError } from "@cosmicdrift/kumiko-framework/db";
 import {
   setupTestStack,
   type TestStack,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { resetTestTables, seedRow, updateRows } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createDataRetentionFeature } from "../../data-retention";
@@ -108,7 +103,7 @@ async function insertJob(
   if (overrides.bytesWritten !== undefined) {
     values["bytesWritten"] = overrides.bytesWritten;
   }
-  await insertOne(stack.db, exportJobsTable, values);
+  await seedRow(stack.db, exportJobsTable, values);
   return id;
 }
 
@@ -178,7 +173,7 @@ describe("ExportJob :: Partial-UNIQUE-Index", () => {
     // Alice pending insert
     const aliceJobId = await insertJob(ALICE_ID, EXPORT_JOB_STATUS.Pending);
     // Worker pickt auf — Status flip
-    await updateMany(
+    await updateRows(
       stack.db,
       exportJobsTable,
       { status: EXPORT_JOB_STATUS.Running },
@@ -193,7 +188,7 @@ describe("ExportJob :: Partial-UNIQUE-Index", () => {
     );
 
     // Aber wenn der running-Job fertig wird (done), darf User wieder pending starten
-    await updateMany(
+    await updateRows(
       stack.db,
       exportJobsTable,
       { status: EXPORT_JOB_STATUS.Done },

package/src/user-data-rights/__tests__/export-job-list-cross-tenant.integration.test.ts

@@ -0,0 +1,84 @@
+// export-job-list/detail :: SystemAdmin cross-tenant visibility.
+//
+// Regression: the changeset describes these as "a platform-operator
+// inspector over the GDPR read-models" (i.e. cross-tenant), but the handlers
+// registered no crossTenant/systemScope override — a SystemAdmin acting in
+// tenant A saw only tenant A's export jobs, never tenant B's.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { createComplianceProfilesFeature } from "../../compliance-profiles";
+import { createDataRetentionFeature } from "../../data-retention";
+import { createSessionsFeature } from "../../sessions";
+import { createUserFeature } from "../../user";
+import { createUserDataRightsFeature } from "../feature";
+import { exportJobEntity, exportJobsTable } from "../schema/export-job";
+
+const REQUEST_EXPORT = "user-data-rights:write:request-export";
+const EXPORT_JOB_LIST = "user-data-rights:query:export-job:list";
+const EXPORT_JOB_DETAIL = "user-data-rights:query:export-job:detail";
+
+let stack: TestStack;
+
+const tenantA = testTenantId(1);
+const tenantB = testTenantId(2);
+const aliceInA = createTestUser({ id: 42, tenantId: tenantA, roles: ["Member"] });
+const bobInB = createTestUser({ id: 43, tenantId: tenantB, roles: ["Member"] });
+const sysadminInA = createTestUser({ id: 1, tenantId: tenantA, roles: ["SystemAdmin"] });
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [
+      createUserFeature(),
+      createDataRetentionFeature(),
+      createComplianceProfilesFeature(),
+      createSessionsFeature(),
+      createUserDataRightsFeature(),
+    ],
+  });
+  await unsafeCreateEntityTable(stack.db, exportJobEntity);
+  await createEventsTable(stack.db);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await resetTestTables(stack.db, [exportJobsTable, eventsTable]);
+});
+
+describe("export-job list/detail :: SystemAdmin sees every tenant's jobs", () => {
+  test("list includes jobs from a tenant the SystemAdmin isn't acting in", async () => {
+    const aJob = await stack.http.writeOk<{ jobId: string }>(REQUEST_EXPORT, {}, aliceInA);
+    const bJob = await stack.http.writeOk<{ jobId: string }>(REQUEST_EXPORT, {}, bobInB);
+
+    const result = await stack.http.queryOk<{ rows: Array<{ id: string }> }>(
+      EXPORT_JOB_LIST,
+      {},
+      sysadminInA,
+    );
+    const ids = result.rows.map((r) => r.id);
+    expect(ids).toContain(aJob.jobId);
+    expect(ids).toContain(bJob.jobId);
+  });
+
+  test("detail resolves a job that belongs to a different tenant than the caller", async () => {
+    const bJob = await stack.http.writeOk<{ jobId: string }>(REQUEST_EXPORT, {}, bobInB);
+
+    const detail = await stack.http.queryOk<{ id: string } | null>(
+      EXPORT_JOB_DETAIL,
+      { id: bJob.jobId },
+      sysadminInA,
+    );
+    expect(detail?.id).toBe(bJob.jobId);
+  });
+});

package/src/user-data-rights/__tests__/file-retention.integration.test.ts

@@ -16,7 +16,7 @@
 //      die Policy entscheidet pro Tenant.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { asRawClient, insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createEventStoreExecutor,
   createTenantDb,
@@ -30,7 +30,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { resetTestTables, seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createDataRetentionFeature, tenantRetentionOverrideEntity } from "../../data-retention";
@@ -117,7 +117,7 @@ beforeEach(async () => {
 });
 
 async function seedForgetUser(id: string): Promise<void> {
-  await insertOne(db, userTable, {
+  await seedRow(db, userTable, {
     id,
     tenantId: TENANT_SYSTEM,
     email: `user-${id}@example.com`,

package/src/user-data-rights/__tests__/forget-cleanup-hook-ordering.integration.test.ts

@@ -15,7 +15,7 @@
 // (getExtensionUsages + direct call) and is structurally blind to ordering.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { asRawClient, insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import {
   createEntity,
@@ -32,6 +32,7 @@ import {
   type TestStack,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { seedRow as seedProjectionRow } from "@cosmicdrift/kumiko-framework/testing";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { fieldDefinitionEntity } from "../../custom-fields/entity";
 import { createCustomFieldsFeature } from "../../custom-fields/feature";
@@ -181,7 +182,7 @@ async function defineSensitiveField(entityName: string, fieldKey: string, sensit
 }
 
 async function seedAnonymizeOverride(entityName: string) {
-  await insertOne(stack.db, tenantRetentionOverrideTable, {
+  await seedProjectionRow(stack.db, tenantRetentionOverrideTable, {
     entityName,
     config: JSON.stringify({ keepFor: "0d", strategy: "anonymize" }),
     reason: "test: force anonymize strategy",

package/src/user-data-rights/__tests__/forget-test-helpers.ts

@@ -4,10 +4,11 @@
 // DDL and seed logic in one place so a file_refs/user-schema change updates
 // both at once instead of drifting.
 
-import { asRawClient, insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import type { FileStorageProvider } from "@cosmicdrift/kumiko-framework/files";
+import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { USER_STATUS, userTable } from "../../user";
 
@@ -66,7 +67,7 @@ export interface ForgetSeeders {
 export function createForgetSeeders(db: DbConnection, writer: FileWriter): ForgetSeeders {
   return {
     async seedForgetUser(id) {
-      await insertOne(db, userTable, {
+      await seedRow(db, userTable, {
         id,
         tenantId: TENANT_SYSTEM,
         email: `user-${id}@example.com`,

package/src/user-data-rights/__tests__/mail-default-bridge.integration.test.ts

@@ -10,7 +10,7 @@
 // #624: "App mountet mail-foundation+transport → GDPR-Mails ohne Callback-Code".
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { asRawClient, insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import {
   setupTestStack,
@@ -18,7 +18,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { resetTestTables, seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { configValuesTable, createConfigFeature, createConfigResolver } from "../../config";
@@ -99,7 +99,7 @@ beforeEach(async () => {
 
 describe("C6 default mail bridge :: forget cron sends deletion-executed without app callback", () => {
   test("registered cron + configResolver(provider=inmemory) → user deleted + mail in inbox", async () => {
-    await insertOne(stack.db, userTable, {
+    await seedRow(stack.db, userTable, {
       id: USER_ID,
       tenantId: TENANT_SYSTEM,
       email: ORIGINAL_EMAIL,

package/src/user-data-rights/__tests__/read-users-rebuild-survives-lifecycle.integration.test.ts

@@ -13,7 +13,7 @@
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import { selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import {
   createRegistry,
@@ -38,7 +38,11 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { createLateBoundHolder, resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import {
+  createLateBoundHolder,
+  resetTestTables,
+  updateRows,
+} from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { AuthHandlers } from "../../auth-email-password/constants";
 import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
@@ -218,7 +222,7 @@ describe("#494 :: read_users-Rebuild bewahrt Lifecycle-State", () => {
     );
 
     // Prae-Fix-Zustand simulieren: roher Write OHNE Event.
-    await updateMany(stack.db, userTable, { status: USER_STATUS.Restricted }, { id: created.id });
+    await updateRows(stack.db, userTable, { status: USER_STATUS.Restricted }, { id: created.id });
 
     // Ohne Backfill replayt der Rebuild nur user.created -> Status weggewischt.
     await rebuildProjection(USER_PROJECTION, { db: stack.db, registry });
@@ -229,7 +233,7 @@ describe("#494 :: read_users-Rebuild bewahrt Lifecycle-State", () => {
 
     // Bestand wieder in den divergenten Live-State bringen (der Rebuild hat ihn
     // auf Active gesetzt) und den Reconcile laufen lassen.
-    await updateMany(stack.db, userTable, { status: USER_STATUS.Restricted }, { id: created.id });
+    await updateRows(stack.db, userTable, { status: USER_STATUS.Restricted }, { id: created.id });
     const { backfilled, failed } = await backfillUserLifecycleEvents(stack.db);
     expect(backfilled).toBeGreaterThanOrEqual(1);
     expect(failed).toEqual([]);
@@ -254,14 +258,14 @@ describe("#494 :: read_users-Rebuild bewahrt Lifecycle-State", () => {
       { email: "healthy.rebuild@example.com", passwordHash: hash, displayName: "Healthy" },
       TestUsers.systemAdmin,
     );
-    await updateMany(stack.db, userTable, { status: USER_STATUS.Restricted }, { id: goodRow.id });
+    await updateRows(stack.db, userTable, { status: USER_STATUS.Restricted }, { id: goodRow.id });
 
     const badRow = await stack.http.writeOk<{ id: string }>(
       UserHandlers.create,
       { email: "corrupt.rebuild@example.com", passwordHash: hash, displayName: "Corrupt" },
       TestUsers.systemAdmin,
     );
-    await updateMany(stack.db, userTable, { status: USER_STATUS.Restricted }, { id: badRow.id });
+    await updateRows(stack.db, userTable, { status: USER_STATUS.Restricted }, { id: badRow.id });
     // userEntity is systemStream:true (schema/user.ts) — its event stream
     // lives on SYSTEM_TENANT_ID regardless of the creating tenant. Archiving
     // under any other tenant would be a silent no-op against assertStreamWritable.

package/src/user-data-rights/__tests__/request-cancel-deletion.integration.test.ts

@@ -10,7 +10,7 @@
 // hier; der Frist-Ablauf-Cleanup folgt mit S2.U5b.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { insertOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -20,7 +20,7 @@ import {
   testUserId,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { resetTestTables, seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import {
   createComplianceProfilesFeature,
@@ -92,7 +92,7 @@ async function seedAlice(
     gracePeriodEnd: Instant | null;
   }> = {},
 ): Promise<void> {
-  await insertOne(stack.db, userTable, {
+  await seedRow(stack.db, userTable, {
     id: aliceUser.id,
     tenantId: tenantA,
     email: "alice@example.com",
@@ -345,7 +345,7 @@ describe("Cross-User-Isolation", () => {
       tenantId: tenantA,
       roles: ["Member"],
     });
-    await insertOne(stack.db, userTable, {
+    await seedRow(stack.db, userTable, {
       id: testUserId(43),
       tenantId: tenantA,
       email: "bob@example.com",

package/src/user-data-rights/__tests__/request-deletion-callback.integration.test.ts

@@ -8,7 +8,7 @@
 // Properties — dieser Test verifiziert sie end-to-end.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { insertOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -17,7 +17,7 @@ import {
   testTenantId,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { resetTestTables, seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import {
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,
@@ -85,7 +85,7 @@ beforeEach(async () => {
 });
 
 async function seedAlice(email: string = "alice@example.com"): Promise<void> {
-  await insertOne(stack.db, userTable, {
+  await seedRow(stack.db, userTable, {
     id: aliceUser.id,
     tenantId: tenantA,
     email,
@@ -153,7 +153,7 @@ describe("request-deletion :: sendDeletionRequestedEmail callback", () => {
   });
 
   test("422 user_not_in_active_state → callback NICHT gefeuert", async () => {
-    await insertOne(stack.db, userTable, {
+    await seedRow(stack.db, userTable, {
       id: aliceUser.id,
       tenantId: tenantA,
       email: "alice@example.com",