@cosmicdrift/kumiko-bundled-features 0.105.2 → 0.109.0

package/src/template-resolver/testing.ts

@@ -2,8 +2,8 @@
 // `@cosmicdrift/kumiko-bundled-features/template-resolver/testing`.
 // No bun:test here — callers register cases with their own test runner.
 
-import { insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import type { ResolveRequest, TemplateResource } from "./api";
 import { TemplateNotFoundError } from "./api";
 import {
@@ -50,7 +50,7 @@ type SeedTemplateArgs = {
 };
 
 async function seedTemplate(db: DbConnection, args: SeedTemplateArgs): Promise<void> {
-  await insertOne(db, templateResourcesTable, {
+  await seedRow(db, templateResourcesTable, {
     tenantId: args.tenantId,
     slug: args.slug,
     kind: args.kind,
@@ -74,10 +74,11 @@ export async function assertConsumerHandlesNotFound(
   const { tenantId } = opts;
   let rejected = false;
   let err: unknown;
+  const slug = `conformance-not-found-${crypto.randomUUID()}`;
   try {
     await consumer.resolve({
       tenantId,
-      slug: "conformance-not-found-slug",
+      slug,
       kind: "mail-html",
       locale: "de",
     });

package/src/tier-engine/feature.ts

@@ -217,6 +217,7 @@ export function createTierEngineFeature<
     r.writeHandler(
       createSetTenantTierWrite({
         onAssigned: (tenantId, tier) => onTierAssigned.fn(tenantId, tier),
+        validTiers: opts.tierMap ? new Set(Object.keys(opts.tierMap)) : undefined,
       }),
     );
     r.queryHandler(getTenantTierQuery);
@@ -452,19 +453,30 @@ export function createTierEngineFeature<
         // tier-assignment-Row, die der seed-Pfad nicht anlegt) und prüft das
         // Fenster gegen die aktuelle Zeit. Nur auf dem disabled-Gate-Pfad
         // konsultiert. inserted_at ist immutable → pro Tenant einmal lesen.
-        const startedMemo = new Map<TenantId, number>();
+        // Promise-memo (not a plain value cache): N concurrent requests for the
+        // same fresh tenant must await the SAME in-flight fetchOne, not each
+        // fire their own — a plain `Map<TenantId, number>` set AFTER the await
+        // lets every concurrent caller miss the cache and issue a redundant
+        // read (benign but wasteful on a signup burst).
+        const startedMemo = new Map<TenantId, Promise<number | undefined>>();
         const trialGate: TrialGate = async (tenantId, featureName) => {
           if (!trialFeatures.has(featureName)) return false;
-          let startedMs = startedMemo.get(tenantId);
-          if (startedMs === undefined) {
-            const row = await fetchOne<{ insertedAt?: Temporal.Instant }>(deps.db, tenantTable, {
+          let startedMsPromise = startedMemo.get(tenantId);
+          if (startedMsPromise === undefined) {
+            startedMsPromise = fetchOne<{ insertedAt?: Temporal.Instant }>(deps.db, tenantTable, {
               id: tenantId,
-            });
-            // Tenant-Row noch nicht projiziert (Replay-Race) → keinen Miss
-            // memoizen, beim nächsten Request neu lesen.
-            if (row?.insertedAt === undefined) return false;
-            startedMs = row.insertedAt.epochMilliseconds;
-            startedMemo.set(tenantId, startedMs);
+            }).then((row) => row?.insertedAt?.epochMilliseconds);
+            // Evict on rejection too — a transient DB error must not poison
+            // every future call for this tenant with the same cached rejection.
+            startedMsPromise.catch(() => startedMemo.delete(tenantId));
+            startedMemo.set(tenantId, startedMsPromise);
+          }
+          const startedMs = await startedMsPromise;
+          // Tenant-Row noch nicht projiziert (Replay-Race) → keinen Miss
+          // memoizen, beim nächsten Request neu lesen.
+          if (startedMs === undefined) {
+            startedMemo.delete(tenantId);
+            return false;
           }
           return isTrialActive(startedMs, nowMs(), trial.durationHours);
         };

package/src/tier-engine/handlers/set-tenant-tier.write.ts

@@ -44,6 +44,12 @@ export type SetTenantTierOptions = {
    *  Cache aktualisieren kann (der Executor-Write feuert den postSave-Hook
    *  nicht). Ohne tierMap kein Resolver → no-op. */
   readonly onAssigned?: (tenantId: TenantId, tier: string) => void;
+  /** Tier-Namen aus der tierMap-Closure — ohne sie (storage-only-Mode) bleibt
+   *  `tier` unvalidiert außer Length/Non-Empty. Mit ihr rejected der Handler
+   *  einen unbekannten Tier-Namen statt ihn stillschweigend durchzuschreiben
+   *  (featuresForTier gibt für unbekannte Namen defensiv ein leeres Set
+   *  zurück — der Tenant verliert sonst lautlos alle Tier-Gates). */
+  readonly validTiers?: ReadonlySet<string>;
 };
 
 export function createSetTenantTierWrite(opts: SetTenantTierOptions = {}) {
@@ -51,7 +57,11 @@ export function createSetTenantTierWrite(opts: SetTenantTierOptions = {}) {
     name: "set-tenant-tier",
     schema: z.object({
       tenantId: z.string().min(1),
-      tier: z.string().min(1).max(50),
+      tier: z
+        .string()
+        .min(1)
+        .max(50)
+        .refine((t) => !opts.validTiers || opts.validTiers.has(t), { message: "unknown tier" }),
     }),
     access: { roles: ["SystemAdmin"] },
     handler: async (event, ctx) => {

package/src/user/__tests__/stream-tenant-backfill.integration.test.ts

@@ -0,0 +1,186 @@
+// #762 — backfillUserStreamTenants: pre-#497 user streams live on the
+// creating tenant; post-#497 the executor addresses SYSTEM_TENANT_ID, so
+// legacy users version-conflict on every write (password-reset collapses to
+// invalid_token). The backfill retenants + renumbers per aggregate in global
+// id order — including the split-stream case the raw #497-changeset SQL
+// crashes on (legacy tenant v1..n AND post-#497 SYSTEM events for the same
+// aggregate → events_aggregate_version_uq violation).
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createSystemUser,
+  SYSTEM_TENANT_ID,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { append, createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestDb,
+  type TestDb,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { backfillUserStreamTenants } from "../db/queries/stream-tenant-backfill";
+import { userEntity, userTable } from "../schema/user";
+
+const T1 = "00000000-0000-4000-8000-000000000011" as TenantId;
+const LEGACY_USER = "aaaaaaaa-0000-4000-8000-000000000001";
+const SPLIT_USER = "aaaaaaaa-0000-4000-8000-000000000002";
+const MODERN_USER = "aaaaaaaa-0000-4000-8000-000000000003";
+
+let testDb: TestDb;
+
+const executor = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
+
+beforeAll(async () => {
+  testDb = await createTestDb();
+  await unsafeCreateEntityTable(testDb.db, userEntity, "user");
+  await createEventsTable(testDb.db);
+});
+
+afterAll(async () => {
+  await testDb.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(testDb.db).unsafe(
+    `TRUNCATE kumiko_events, kumiko_snapshots, kumiko_archived_streams, read_users RESTART IDENTITY CASCADE`,
+  );
+});
+
+async function appendUserEvent(
+  aggregateId: string,
+  tenantId: TenantId,
+  expectedVersion: number,
+  type: string,
+  payload: Record<string, unknown>,
+): Promise<void> {
+  await append(testDb.db, {
+    aggregateId,
+    aggregateType: "user",
+    tenantId,
+    expectedVersion,
+    type,
+    payload,
+    metadata: { userId: "test-migrator" },
+  });
+}
+
+async function streamRows(
+  aggregateId: string,
+): Promise<ReadonlyArray<{ tenant_id: string; version: number; type: string }>> {
+  return (await asRawClient(testDb.db).unsafe(
+    `SELECT "tenant_id", "version", "type" FROM "kumiko_events"
+      WHERE "aggregate_id" = $1::uuid ORDER BY "id" ASC`,
+    [aggregateId],
+  )) as ReadonlyArray<{ tenant_id: string; version: number; type: string }>;
+}
+
+function seedUserRow(id: string, tenantId: TenantId, version: number) {
+  return asRawClient(testDb.db).unsafe(
+    `INSERT INTO "read_users" ("id", "tenant_id", "email", "display_name", "locale", "password_hash", "status", "version")
+     VALUES ($1::uuid, $2::uuid, $3, 'Legacy', 'de', 'x', 'active', $4)`,
+    [id, tenantId, `${id.slice(0, 8)}@example.com`, version],
+  );
+}
+
+describe("backfillUserStreamTenants (#762)", () => {
+  test("legacy stream: retenanted to SYSTEM, versions contiguous, executor write works again", async () => {
+    await appendUserEvent(LEGACY_USER, T1, 0, "user.created", { email: "l@example.com" });
+    await appendUserEvent(LEGACY_USER, T1, 1, "user.updated", { changes: { displayName: "L" } });
+    await seedUserRow(LEGACY_USER, T1, 2);
+
+    const result = await backfillUserStreamTenants(testDb.db);
+    expect(result.aggregatesMigrated).toBe(1);
+    expect(result.eventsMigrated).toBe(2);
+    expect(result.failed).toHaveLength(0);
+
+    const rows = await streamRows(LEGACY_USER);
+    expect(rows.map((r) => r.tenant_id)).toEqual([SYSTEM_TENANT_ID, SYSTEM_TENANT_ID]);
+    expect(rows.map((r) => r.version)).toEqual([1, 2]);
+
+    // The actual #762 symptom: an optimistic-locked executor update with the
+    // row version now targets a stream that HAS that version — no conflict.
+    const tdb = createTenantDb(testDb.db, SYSTEM_TENANT_ID, "system");
+    const writeRes = await executor.update(
+      { id: LEGACY_USER, version: 2, changes: { displayName: "After" } },
+      createSystemUser(SYSTEM_TENANT_ID),
+      tdb,
+    );
+    expect(writeRes.isSuccess).toBe(true);
+  });
+
+  test("split stream (legacy + post-#497 SYSTEM events) merges in global id order", async () => {
+    // Legacy: created + updated on T1 (v1, v2). Then a post-#497 lifecycle
+    // write appended v1 on SYSTEM — the split the raw changeset-SQL trips on.
+    await appendUserEvent(SPLIT_USER, T1, 0, "user.created", { email: "s@example.com" });
+    await appendUserEvent(SPLIT_USER, T1, 1, "user.updated", { changes: { a: 1 } });
+    await appendUserEvent(SPLIT_USER, SYSTEM_TENANT_ID, 0, "user.updated", {
+      changes: { status: "restricted" },
+    });
+    await seedUserRow(SPLIT_USER, T1, 2);
+
+    const result = await backfillUserStreamTenants(testDb.db);
+    expect(result.aggregatesMigrated).toBe(1);
+    expect(result.eventsMigrated).toBe(3);
+    expect(result.failed).toHaveLength(0);
+
+    const rows = await streamRows(SPLIT_USER);
+    expect(rows.map((r) => r.tenant_id)).toEqual([
+      SYSTEM_TENANT_ID,
+      SYSTEM_TENANT_ID,
+      SYSTEM_TENANT_ID,
+    ]);
+    // Renumbered by global event id: created, updated(T1), updated(SYSTEM).
+    expect(rows.map((r) => r.version)).toEqual([1, 2, 3]);
+    expect(rows[0]?.type).toBe("user.created");
+  });
+
+  test("idempotent: second run finds nothing; modern SYSTEM streams untouched", async () => {
+    await appendUserEvent(MODERN_USER, SYSTEM_TENANT_ID, 0, "user.created", {
+      email: "m@example.com",
+    });
+    await appendUserEvent(LEGACY_USER, T1, 0, "user.created", { email: "l@example.com" });
+
+    const first = await backfillUserStreamTenants(testDb.db);
+    expect(first.aggregatesMigrated).toBe(1);
+
+    const second = await backfillUserStreamTenants(testDb.db);
+    expect(second.aggregatesMigrated).toBe(0);
+    expect(second.eventsMigrated).toBe(0);
+
+    const modern = await streamRows(MODERN_USER);
+    expect(modern).toHaveLength(1);
+    expect(modern[0]?.version).toBe(1);
+  });
+
+  test("stale snapshots dropped, archived-stream marker moves to SYSTEM", async () => {
+    await appendUserEvent(LEGACY_USER, T1, 0, "user.created", { email: "l@example.com" });
+    await asRawClient(testDb.db).unsafe(
+      `INSERT INTO "kumiko_snapshots" ("aggregate_id", "aggregate_type", "tenant_id", "version", "state")
+       VALUES ($1::uuid, 'user', $2::uuid, 1, '{}'::jsonb)`,
+      [LEGACY_USER, T1],
+    );
+    await asRawClient(testDb.db).unsafe(
+      `INSERT INTO "kumiko_archived_streams" ("tenant_id", "aggregate_id", "aggregate_type", "archived_by")
+       VALUES ($1::uuid, $2::uuid, 'user', 'test')`,
+      [T1, LEGACY_USER],
+    );
+
+    const result = await backfillUserStreamTenants(testDb.db);
+    expect(result.failed).toHaveLength(0);
+
+    const snapshots = (await asRawClient(testDb.db).unsafe(
+      `SELECT count(*)::int AS n FROM "kumiko_snapshots" WHERE "aggregate_id" = $1::uuid`,
+      [LEGACY_USER],
+    )) as ReadonlyArray<{ n: number }>;
+    expect(snapshots[0]?.n).toBe(0);
+
+    const archived = (await asRawClient(testDb.db).unsafe(
+      `SELECT "tenant_id" FROM "kumiko_archived_streams" WHERE "aggregate_id" = $1::uuid`,
+      [LEGACY_USER],
+    )) as ReadonlyArray<{ tenant_id: string }>;
+    expect(archived).toHaveLength(1);
+    expect(archived[0]?.tenant_id).toBe(SYSTEM_TENANT_ID);
+  });
+});

package/src/user/db/queries/stream-tenant-backfill.ts

@@ -0,0 +1,112 @@
+// #762 — one-time migration tooling for pre-#497 user event streams.
+//
+// #497 made `user` a systemStream entity: every executor op addresses the
+// stream on SYSTEM_TENANT_ID. Streams created before that live on whichever
+// tenant created them ("scattered"), so post-#497 writes version-conflict
+// against the empty SYSTEM stream. The raw UPDATE documented in the #497
+// changeset breaks as soon as an aggregate has BOTH a legacy stream and
+// post-#497 SYSTEM events (split stream — e.g. a skipOptimisticLock
+// lifecycle write appended v1 on SYSTEM while v1..n live on the old
+// tenant): retenanting then trips events_aggregate_version_uq.
+//
+// This tool merges per aggregate: all user events, ordered by global event
+// id, are renumbered 1..n and retenanted to SYSTEM_TENANT_ID — two-phase
+// version writes (negative interim values) dodge the unique index while the
+// per-aggregate transaction is in flight. Snapshots of migrated aggregates
+// are dropped (version numbering changed; the next snapshotting load
+// recreates them); archived-stream markers move with the stream.
+//
+// Idempotent: the candidate query only matches aggregates that still have
+// non-SYSTEM events. One failing aggregate does not abort the run — the
+// rest of the estate migrates, failures are reported.
+//
+// After a run, rebuild the user projection so read_users.tenant_id reflects
+// the stream move: rebuildProjection("user:projection:user-entity", ...) or
+// the jobs:job:projection-rebuild job.
+
+import { asRawClient, transaction } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+
+export type UserStreamBackfillResult = {
+  readonly aggregatesMigrated: number;
+  readonly eventsMigrated: number;
+  readonly failed: ReadonlyArray<{ readonly aggregateId: string; readonly error: string }>;
+};
+
+export async function backfillUserStreamTenants(
+  db: DbConnection,
+): Promise<UserStreamBackfillResult> {
+  const candidates = (await asRawClient(db).unsafe(
+    `SELECT DISTINCT "aggregate_id" FROM "kumiko_events"
+      WHERE "aggregate_type" = 'user' AND "tenant_id" <> $1::uuid`,
+    [SYSTEM_TENANT_ID],
+  )) as ReadonlyArray<{ aggregate_id: string }>;
+
+  let aggregatesMigrated = 0;
+  let eventsMigrated = 0;
+  const failed: Array<{ aggregateId: string; error: string }> = [];
+
+  for (const { aggregate_id } of candidates) {
+    try {
+      eventsMigrated += await migrateAggregate(db, aggregate_id);
+      aggregatesMigrated++;
+    } catch (e) {
+      failed.push({
+        aggregateId: aggregate_id,
+        error: e instanceof Error ? e.message : String(e),
+      });
+    }
+  }
+  return { aggregatesMigrated, eventsMigrated, failed };
+}
+
+async function migrateAggregate(db: DbConnection, aggregateId: string): Promise<number> {
+  return transaction(db, async (tx) => {
+    const raw = asRawClient(tx);
+    // Global id order = commit-adjacent replay order; merges a split stream
+    // (legacy tenant + SYSTEM) into one consistent version sequence.
+    const events = (await raw.unsafe(
+      `SELECT "id" FROM "kumiko_events"
+        WHERE "aggregate_type" = 'user' AND "aggregate_id" = $1::uuid
+        ORDER BY "id" ASC
+        FOR UPDATE`,
+      [aggregateId],
+    )) as ReadonlyArray<{ id: bigint | string }>;
+
+    // Phase 1: negative interim versions — real versions are always >= 1, so
+    // nothing can collide with events_aggregate_version_uq mid-migration.
+    for (const [i, ev] of events.entries()) {
+      await raw.unsafe(
+        `UPDATE "kumiko_events" SET "tenant_id" = $1::uuid, "version" = $2 WHERE "id" = $3`,
+        [SYSTEM_TENANT_ID, -(i + 1), ev.id],
+      );
+    }
+    // Phase 2: final contiguous 1..n.
+    for (const [i, ev] of events.entries()) {
+      await raw.unsafe(`UPDATE "kumiko_events" SET "version" = $1 WHERE "id" = $2`, [i + 1, ev.id]);
+    }
+
+    // Version numbering changed → any snapshot of this aggregate is stale.
+    await raw.unsafe(`DELETE FROM "kumiko_snapshots" WHERE "aggregate_id" = $1::uuid`, [
+      aggregateId,
+    ]);
+
+    // Archived markers key on (tenant_id, aggregate_id) — move them with the
+    // stream, keeping an existing SYSTEM marker if both exist.
+    await raw.unsafe(
+      `INSERT INTO "kumiko_archived_streams" ("tenant_id", "aggregate_id", "aggregate_type", "archived_at", "archived_by", "reason")
+        SELECT $1::uuid, "aggregate_id", "aggregate_type", "archived_at", "archived_by", "reason"
+          FROM "kumiko_archived_streams"
+         WHERE "aggregate_id" = $2::uuid AND "tenant_id" <> $1::uuid
+        ON CONFLICT DO NOTHING`,
+      [SYSTEM_TENANT_ID, aggregateId],
+    );
+    await raw.unsafe(
+      `DELETE FROM "kumiko_archived_streams" WHERE "aggregate_id" = $1::uuid AND "tenant_id" <> $2::uuid`,
+      [aggregateId, SYSTEM_TENANT_ID],
+    );
+
+    return events.length;
+  });
+}

package/src/user/index.ts

@@ -1,5 +1,9 @@
 export { UserCommandSchemas } from "./command-schemas";
 export { USER_FEATURE, UserErrors, UserHandlers, UserQueries } from "./constants";
+export {
+  backfillUserStreamTenants,
+  type UserStreamBackfillResult,
+} from "./db/queries/stream-tenant-backfill";
 export { createUserFeature } from "./feature";
 export type { UserStatus } from "./schema/user";
 export {

package/src/user-data-rights/__tests__/anonymous-deletion.integration.test.ts

@@ -6,7 +6,7 @@
 // Beweist end-to-end via echte /api/write-Calls OHNE Auth (anonymousAccess).
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { insertOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -15,7 +15,7 @@ import {
   testTenantId,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { resetTestTables, seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import {
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,
@@ -77,7 +77,7 @@ beforeEach(async () => {
 });
 
 async function seedAlice(status: string = USER_STATUS.Active, email: string = ALICE_EMAIL) {
-  await insertOne(stack.db, userTable, {
+  await seedRow(stack.db, userTable, {
     id: aliceUser.id,
     tenantId: tenantA,
     email,
@@ -343,7 +343,7 @@ describe("anonymous deletion flow — not configured (kein Secret)", () => {
     await unsafeCreateEntityTable(bareStack.db, userEntity);
     await unsafeCreateEntityTable(bareStack.db, tenantComplianceProfileEntity);
     await createEventsTable(bareStack.db);
-    await insertOne(bareStack.db, userTable, {
+    await seedRow(bareStack.db, userTable, {
       id: aliceUser.id,
       tenantId: tenantA,
       email: ALICE_EMAIL,

package/src/user-data-rights/__tests__/audit-log.integration.test.ts

@@ -1,7 +1,7 @@
 // S2.U7 — my-audit-log + invalid-attempt-audit + list-download-attempts.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { asRawClient, insertMany, insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -10,7 +10,7 @@ import {
   testTenantId,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { resetTestTables, seedRow, seedRows } from "@cosmicdrift/kumiko-framework/testing";
 import {
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,
@@ -64,7 +64,7 @@ beforeEach(async () => {
 });
 
 async function seedUser(u: typeof alice, email: string): Promise<void> {
-  await insertOne(stack.db, userTable, {
+  await seedRow(stack.db, userTable, {
     id: u.id,
     tenantId: u.tenantId,
     email,
@@ -180,7 +180,7 @@ describe("list-download-attempts (DPO operator-query)", () => {
     // Direct-INSERT in attempts (simuliert was die download-handler schreiben).
     const T = await import("@cosmicdrift/kumiko-framework/time");
     const now = T.getTemporal().Now.instant();
-    await insertMany(stack.db, downloadAttemptsTable, [
+    await seedRows(stack.db, downloadAttemptsTable, [
       {
         id: "11111111-1111-4111-8111-111111111111",
         tenantId: tenantA,

package/src/user-data-rights/__tests__/cross-data-matrix.integration.test.ts

@@ -13,7 +13,7 @@
 //     Alices Forget; Bobs Daten landen NICHT in Alices Export-Bundle.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { asRawClient, deleteMany, insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineUnmanagedTable } from "@cosmicdrift/kumiko-framework/db";
 import {
   defineFeature,
@@ -28,7 +28,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { deleteRows, resetTestTables, seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import {
   createComplianceProfilesFeature,
@@ -98,7 +98,7 @@ const exportNotes: UserDataExportHook = async (ctx) => {
 };
 
 const deleteNotes: UserDataDeleteHook = async (ctx, _strategy) => {
-  await deleteMany(ctx.db, testNotesTable, {
+  await deleteRows(ctx.db, testNotesTable, {
     tenantId: ctx.tenantId,
     authorId: ctx.userId,
   });
@@ -182,7 +182,7 @@ async function seedUser(
     displayName?: string;
   } = {},
 ): Promise<void> {
-  await insertOne(stack.db, userTable, {
+  await seedRow(stack.db, userTable, {
     id,
     tenantId: TENANT_SYSTEM,
     email: overrides.email ?? `user-${id}@example.com`,

package/src/user-data-rights/__tests__/download.integration.test.ts

@@ -9,7 +9,7 @@
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import { asRawClient, selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
@@ -25,7 +25,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { resetTestTables, updateRows } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import {
   createComplianceProfilesFeature,
@@ -302,7 +302,7 @@ describe("download-by-token :: error paths", () => {
     const longAgo = getTemporal().Instant.fromEpochMilliseconds(
       Date.now() - 365 * 24 * 60 * 60 * 1000,
     );
-    await updateMany(stack.db, exportDownloadTokensTable, { expiresAt: longAgo }, { jobId });
+    await updateRows(stack.db, exportDownloadTokensTable, { expiresAt: longAgo }, { jobId });
 
     const res = await stack.http.query(
       "user-data-rights:query:download-by-token",
@@ -316,7 +316,7 @@ describe("download-by-token :: error paths", () => {
 
   test("failed Job → 404 download.unavailable", async () => {
     const { jobId, plainToken } = await seedDoneJobWithToken();
-    await updateMany(stack.db, exportJobsTable, { status: "failed" }, { id: jobId });
+    await updateRows(stack.db, exportJobsTable, { status: "failed" }, { id: jobId });
 
     const res = await stack.http.query(
       "user-data-rights:query:download-by-token",
@@ -330,7 +330,7 @@ describe("download-by-token :: error paths", () => {
 
   test("storage cleared → 404 download.expired", async () => {
     const { jobId, plainToken } = await seedDoneJobWithToken();
-    await updateMany(stack.db, exportJobsTable, { downloadStorageKey: null }, { id: jobId });
+    await updateRows(stack.db, exportJobsTable, { downloadStorageKey: null }, { id: jobId });
 
     const res = await stack.http.query(
       "user-data-rights:query:download-by-token",
@@ -404,7 +404,7 @@ describe("download-by-job :: happy path", () => {
     // Symmetrisch zum token-Test: gleicher Code-Pfad muss auch im job-
     // handler 404 + unavailable raus, nicht 500.
     const { jobId } = await seedDoneJobWithToken();
-    await updateMany(stack.db, exportJobsTable, { status: "failed" }, { id: jobId });
+    await updateRows(stack.db, exportJobsTable, { status: "failed" }, { id: jobId });
 
     const res = await stack.http.query(
       "user-data-rights:query:download-by-job",
@@ -418,7 +418,7 @@ describe("download-by-job :: happy path", () => {
 
   test("storage cleared (downloadStorageKey null) → 404 download.expired (job-Pfad)", async () => {
     const { jobId } = await seedDoneJobWithToken();
-    await updateMany(stack.db, exportJobsTable, { downloadStorageKey: null }, { id: jobId });
+    await updateRows(stack.db, exportJobsTable, { downloadStorageKey: null }, { id: jobId });
 
     const res = await stack.http.query(
       "user-data-rights:query:download-by-job",

package/src/user-data-rights/__tests__/export-job-idempotency.integration.test.ts

@@ -10,19 +10,14 @@
 // reale Postgres + Drizzle-customType-Codec-Path braucht.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import {
-  asRawClient,
-  insertOne,
-  selectMany,
-  updateMany,
-} from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { extractPgError } from "@cosmicdrift/kumiko-framework/db";
 import {
   setupTestStack,
   type TestStack,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { resetTestTables, seedRow, updateRows } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createDataRetentionFeature } from "../../data-retention";
@@ -108,7 +103,7 @@ async function insertJob(
   if (overrides.bytesWritten !== undefined) {
     values["bytesWritten"] = overrides.bytesWritten;
   }
-  await insertOne(stack.db, exportJobsTable, values);
+  await seedRow(stack.db, exportJobsTable, values);
   return id;
 }
 
@@ -178,7 +173,7 @@ describe("ExportJob :: Partial-UNIQUE-Index", () => {
     // Alice pending insert
     const aliceJobId = await insertJob(ALICE_ID, EXPORT_JOB_STATUS.Pending);
     // Worker pickt auf — Status flip
-    await updateMany(
+    await updateRows(
       stack.db,
       exportJobsTable,
       { status: EXPORT_JOB_STATUS.Running },
@@ -193,7 +188,7 @@ describe("ExportJob :: Partial-UNIQUE-Index", () => {
     );
 
     // Aber wenn der running-Job fertig wird (done), darf User wieder pending starten
-    await updateMany(
+    await updateRows(
       stack.db,
       exportJobsTable,
       { status: EXPORT_JOB_STATUS.Done },