@cosmicdrift/kumiko-bundled-features 0.105.2 → 0.109.0

package/src/user-data-rights/__tests__/export-job-list-cross-tenant.integration.test.ts

@@ -0,0 +1,84 @@
+// export-job-list/detail :: SystemAdmin cross-tenant visibility.
+//
+// Regression: the changeset describes these as "a platform-operator
+// inspector over the GDPR read-models" (i.e. cross-tenant), but the handlers
+// registered no crossTenant/systemScope override — a SystemAdmin acting in
+// tenant A saw only tenant A's export jobs, never tenant B's.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { createComplianceProfilesFeature } from "../../compliance-profiles";
+import { createDataRetentionFeature } from "../../data-retention";
+import { createSessionsFeature } from "../../sessions";
+import { createUserFeature } from "../../user";
+import { createUserDataRightsFeature } from "../feature";
+import { exportJobEntity, exportJobsTable } from "../schema/export-job";
+
+const REQUEST_EXPORT = "user-data-rights:write:request-export";
+const EXPORT_JOB_LIST = "user-data-rights:query:export-job:list";
+const EXPORT_JOB_DETAIL = "user-data-rights:query:export-job:detail";
+
+let stack: TestStack;
+
+const tenantA = testTenantId(1);
+const tenantB = testTenantId(2);
+const aliceInA = createTestUser({ id: 42, tenantId: tenantA, roles: ["Member"] });
+const bobInB = createTestUser({ id: 43, tenantId: tenantB, roles: ["Member"] });
+const sysadminInA = createTestUser({ id: 1, tenantId: tenantA, roles: ["SystemAdmin"] });
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [
+      createUserFeature(),
+      createDataRetentionFeature(),
+      createComplianceProfilesFeature(),
+      createSessionsFeature(),
+      createUserDataRightsFeature(),
+    ],
+  });
+  await unsafeCreateEntityTable(stack.db, exportJobEntity);
+  await createEventsTable(stack.db);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await resetTestTables(stack.db, [exportJobsTable, eventsTable]);
+});
+
+describe("export-job list/detail :: SystemAdmin sees every tenant's jobs", () => {
+  test("list includes jobs from a tenant the SystemAdmin isn't acting in", async () => {
+    const aJob = await stack.http.writeOk<{ jobId: string }>(REQUEST_EXPORT, {}, aliceInA);
+    const bJob = await stack.http.writeOk<{ jobId: string }>(REQUEST_EXPORT, {}, bobInB);
+
+    const result = await stack.http.queryOk<{ rows: Array<{ id: string }> }>(
+      EXPORT_JOB_LIST,
+      {},
+      sysadminInA,
+    );
+    const ids = result.rows.map((r) => r.id);
+    expect(ids).toContain(aJob.jobId);
+    expect(ids).toContain(bJob.jobId);
+  });
+
+  test("detail resolves a job that belongs to a different tenant than the caller", async () => {
+    const bJob = await stack.http.writeOk<{ jobId: string }>(REQUEST_EXPORT, {}, bobInB);
+
+    const detail = await stack.http.queryOk<{ id: string } | null>(
+      EXPORT_JOB_DETAIL,
+      { id: bJob.jobId },
+      sysadminInA,
+    );
+    expect(detail?.id).toBe(bJob.jobId);
+  });
+});

package/src/user-data-rights/__tests__/file-retention.integration.test.ts

@@ -16,7 +16,7 @@
 //      die Policy entscheidet pro Tenant.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { asRawClient, insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createEventStoreExecutor,
   createTenantDb,
@@ -30,7 +30,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { resetTestTables, seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createDataRetentionFeature, tenantRetentionOverrideEntity } from "../../data-retention";
@@ -117,7 +117,7 @@ beforeEach(async () => {
 });
 
 async function seedForgetUser(id: string): Promise<void> {
-  await insertOne(db, userTable, {
+  await seedRow(db, userTable, {
     id,
     tenantId: TENANT_SYSTEM,
     email: `user-${id}@example.com`,

package/src/user-data-rights/__tests__/forget-cleanup-hook-ordering.integration.test.ts

@@ -15,7 +15,7 @@
 // (getExtensionUsages + direct call) and is structurally blind to ordering.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { asRawClient, insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import {
   createEntity,
@@ -32,6 +32,7 @@ import {
   type TestStack,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { seedRow as seedProjectionRow } from "@cosmicdrift/kumiko-framework/testing";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { fieldDefinitionEntity } from "../../custom-fields/entity";
 import { createCustomFieldsFeature } from "../../custom-fields/feature";
@@ -181,7 +182,7 @@ async function defineSensitiveField(entityName: string, fieldKey: string, sensit
 }
 
 async function seedAnonymizeOverride(entityName: string) {
-  await insertOne(stack.db, tenantRetentionOverrideTable, {
+  await seedProjectionRow(stack.db, tenantRetentionOverrideTable, {
     entityName,
     config: JSON.stringify({ keepFor: "0d", strategy: "anonymize" }),
     reason: "test: force anonymize strategy",

package/src/user-data-rights/__tests__/forget-test-helpers.ts

@@ -4,10 +4,11 @@
 // DDL and seed logic in one place so a file_refs/user-schema change updates
 // both at once instead of drifting.
 
-import { asRawClient, insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import type { FileStorageProvider } from "@cosmicdrift/kumiko-framework/files";
+import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { USER_STATUS, userTable } from "../../user";
 
@@ -66,7 +67,7 @@ export interface ForgetSeeders {
 export function createForgetSeeders(db: DbConnection, writer: FileWriter): ForgetSeeders {
   return {
     async seedForgetUser(id) {
-      await insertOne(db, userTable, {
+      await seedRow(db, userTable, {
         id,
         tenantId: TENANT_SYSTEM,
         email: `user-${id}@example.com`,

package/src/user-data-rights/__tests__/mail-default-bridge.integration.test.ts

@@ -10,7 +10,7 @@
 // #624: "App mountet mail-foundation+transport → GDPR-Mails ohne Callback-Code".
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { asRawClient, insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import {
   setupTestStack,
@@ -18,7 +18,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { resetTestTables, seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { configValuesTable, createConfigFeature, createConfigResolver } from "../../config";
@@ -99,7 +99,7 @@ beforeEach(async () => {
 
 describe("C6 default mail bridge :: forget cron sends deletion-executed without app callback", () => {
   test("registered cron + configResolver(provider=inmemory) → user deleted + mail in inbox", async () => {
-    await insertOne(stack.db, userTable, {
+    await seedRow(stack.db, userTable, {
       id: USER_ID,
       tenantId: TENANT_SYSTEM,
       email: ORIGINAL_EMAIL,

package/src/user-data-rights/__tests__/read-users-rebuild-survives-lifecycle.integration.test.ts

@@ -13,7 +13,7 @@
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import { selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import {
   createRegistry,
@@ -38,7 +38,11 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { createLateBoundHolder, resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import {
+  createLateBoundHolder,
+  resetTestTables,
+  updateRows,
+} from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { AuthHandlers } from "../../auth-email-password/constants";
 import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
@@ -218,7 +222,7 @@ describe("#494 :: read_users-Rebuild bewahrt Lifecycle-State", () => {
     );
 
     // Prae-Fix-Zustand simulieren: roher Write OHNE Event.
-    await updateMany(stack.db, userTable, { status: USER_STATUS.Restricted }, { id: created.id });
+    await updateRows(stack.db, userTable, { status: USER_STATUS.Restricted }, { id: created.id });
 
     // Ohne Backfill replayt der Rebuild nur user.created -> Status weggewischt.
     await rebuildProjection(USER_PROJECTION, { db: stack.db, registry });
@@ -229,7 +233,7 @@ describe("#494 :: read_users-Rebuild bewahrt Lifecycle-State", () => {
 
     // Bestand wieder in den divergenten Live-State bringen (der Rebuild hat ihn
     // auf Active gesetzt) und den Reconcile laufen lassen.
-    await updateMany(stack.db, userTable, { status: USER_STATUS.Restricted }, { id: created.id });
+    await updateRows(stack.db, userTable, { status: USER_STATUS.Restricted }, { id: created.id });
     const { backfilled, failed } = await backfillUserLifecycleEvents(stack.db);
     expect(backfilled).toBeGreaterThanOrEqual(1);
     expect(failed).toEqual([]);
@@ -254,14 +258,14 @@ describe("#494 :: read_users-Rebuild bewahrt Lifecycle-State", () => {
       { email: "healthy.rebuild@example.com", passwordHash: hash, displayName: "Healthy" },
       TestUsers.systemAdmin,
     );
-    await updateMany(stack.db, userTable, { status: USER_STATUS.Restricted }, { id: goodRow.id });
+    await updateRows(stack.db, userTable, { status: USER_STATUS.Restricted }, { id: goodRow.id });
 
     const badRow = await stack.http.writeOk<{ id: string }>(
       UserHandlers.create,
       { email: "corrupt.rebuild@example.com", passwordHash: hash, displayName: "Corrupt" },
       TestUsers.systemAdmin,
     );
-    await updateMany(stack.db, userTable, { status: USER_STATUS.Restricted }, { id: badRow.id });
+    await updateRows(stack.db, userTable, { status: USER_STATUS.Restricted }, { id: badRow.id });
     // userEntity is systemStream:true (schema/user.ts) — its event stream
     // lives on SYSTEM_TENANT_ID regardless of the creating tenant. Archiving
     // under any other tenant would be a silent no-op against assertStreamWritable.

package/src/user-data-rights/__tests__/request-cancel-deletion.integration.test.ts

@@ -10,7 +10,7 @@
 // hier; der Frist-Ablauf-Cleanup folgt mit S2.U5b.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { insertOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -20,7 +20,7 @@ import {
   testUserId,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { resetTestTables, seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import {
   createComplianceProfilesFeature,
@@ -92,7 +92,7 @@ async function seedAlice(
     gracePeriodEnd: Instant | null;
   }> = {},
 ): Promise<void> {
-  await insertOne(stack.db, userTable, {
+  await seedRow(stack.db, userTable, {
     id: aliceUser.id,
     tenantId: tenantA,
     email: "alice@example.com",
@@ -345,7 +345,7 @@ describe("Cross-User-Isolation", () => {
       tenantId: tenantA,
       roles: ["Member"],
     });
-    await insertOne(stack.db, userTable, {
+    await seedRow(stack.db, userTable, {
       id: testUserId(43),
       tenantId: tenantA,
       email: "bob@example.com",

package/src/user-data-rights/__tests__/request-deletion-callback.integration.test.ts

@@ -8,7 +8,7 @@
 // Properties — dieser Test verifiziert sie end-to-end.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { insertOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -17,7 +17,7 @@ import {
   testTenantId,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { resetTestTables, seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import {
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,
@@ -85,7 +85,7 @@ beforeEach(async () => {
 });
 
 async function seedAlice(email: string = "alice@example.com"): Promise<void> {
-  await insertOne(stack.db, userTable, {
+  await seedRow(stack.db, userTable, {
     id: aliceUser.id,
     tenantId: tenantA,
     email,
@@ -153,7 +153,7 @@ describe("request-deletion :: sendDeletionRequestedEmail callback", () => {
   });
 
   test("422 user_not_in_active_state → callback NICHT gefeuert", async () => {
-    await insertOne(stack.db, userTable, {
+    await seedRow(stack.db, userTable, {
       id: aliceUser.id,
       tenantId: tenantA,
       email: "alice@example.com",

package/src/user-data-rights/__tests__/request-export.integration.test.ts

@@ -18,12 +18,7 @@
 //     hasJob=false wenn nichts da
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import {
-  asRawClient,
-  insertOne,
-  selectMany,
-  updateMany,
-} from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -32,7 +27,7 @@ import {
   testTenantId,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { resetTestTables, seedRow, updateRows } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createDataRetentionFeature } from "../../data-retention";
@@ -136,7 +131,7 @@ describe("request-export :: App-side-Idempotency (primaerer Pfad)", () => {
   test("Klick nach done-Job ist NEUER Job (Audit-Historie wird nicht blockiert)", async () => {
     const first = await stack.http.writeOk<RequestExportResponse>(REQUEST_EXPORT, {}, aliceUser);
     // Worker-Simulation: status auf done flippen (direct-update OK in Test)
-    await updateMany(
+    await updateRows(
       stack.db,
       exportJobsTable,
       { status: EXPORT_JOB_STATUS.Done },
@@ -251,7 +246,7 @@ describe("export-status :: User-Polling", () => {
     const T = getTemporal();
     // 1. Job done in der Vergangenheit
     const oldJobId = "11111111-1111-4111-8111-111111111111";
-    await insertOne(stack.db, exportJobsTable, {
+    await seedRow(stack.db, exportJobsTable, {
       id: oldJobId,
       tenantId: tenantA,
       userId: aliceUser.id,

package/src/user-data-rights/__tests__/restriction-flow.integration.test.ts

@@ -12,7 +12,7 @@
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import { selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
@@ -24,7 +24,11 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { createLateBoundHolder, resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import {
+  createLateBoundHolder,
+  resetTestTables,
+  updateRows,
+} from "@cosmicdrift/kumiko-framework/testing";
 import { AuthErrors, AuthHandlers } from "../../auth-email-password/constants";
 import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
 import { hashPassword } from "../../auth-email-password/password-hashing";
@@ -117,7 +121,7 @@ async function seedAliceWithMembership(
     TestUsers.systemAdmin,
   );
   if (status !== USER_STATUS.Active) {
-    await updateMany(stack.db, userTable, { status }, { id: created.id });
+    await updateRows(stack.db, userTable, { status }, { id: created.id });
   }
   await seedTenantMembership(stack.db, {
     userId: created.id,

package/src/user-data-rights/__tests__/run-export-jobs-cron-context.integration.test.ts

@@ -10,8 +10,8 @@
 // jeden Export auf "failed" setzte).
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { asRawClient, insertOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { SYSTEM_USER_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { type JobContext, SYSTEM_USER_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   setupTestStack,
@@ -19,6 +19,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import {
   createComplianceProfilesFeature,
@@ -104,7 +105,7 @@ beforeEach(async () => {
   await raw.unsafe("DELETE FROM read_export_jobs");
   await raw.unsafe("DELETE FROM read_users");
   await raw.unsafe("DELETE FROM read_tenant_memberships");
-  await insertOne(stack.db, userTable, {
+  await seedRow(stack.db, userTable, {
     id: USER_ID,
     tenantId: TENANT,
     email: "export-cron@example.test",
@@ -146,7 +147,10 @@ describe("run-export-jobs cron-context", () => {
       now: getTemporal().Now.instant(),
     };
     // Vor dem Fix wirft der Wrapper hier "ctx.config is missing".
-    await job?.handler({}, jobCtx as never);
+    // jobCtx is a deliberately minimal prod-context replica (missing
+    // systemUser/log/triggeredBy) — double-cast at this test boundary since
+    // the handler under test never touches those fields.
+    await job?.handler({}, jobCtx as unknown as JobContext);
 
     const [row] = (await selectMany(stack.db, exportJobsTable, { id: jobId })) as Array<{
       status: string;

package/src/user-data-rights/__tests__/run-export-jobs.integration.test.ts

@@ -17,12 +17,7 @@ import { spawn } from "node:child_process";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import {
-  asRawClient,
-  insertOne,
-  selectMany,
-  updateMany,
-} from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createInMemoryFileProvider,
@@ -35,7 +30,7 @@ import {
   testTenantId,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { resetTestTables, seedRow, updateRows } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import {
   createComplianceProfilesFeature,
@@ -112,7 +107,7 @@ beforeEach(async () => {
 
   // Atom 5: aliceUser-Row mit email seeden — Worker-Notification-Callback
   // schaut email via lookupUserEmail an.
-  await insertOne(stack.db, userTable, {
+  await seedRow(stack.db, userTable, {
     id: String(aliceUser.id),
     tenantId: tenantA,
     email: "alice@example.com",
@@ -222,7 +217,7 @@ describe("runExportJobs :: stale-detection", () => {
     const jobId = await seedPendingJob();
     const T = getTemporal();
     const twoHoursAgo = T.Instant.fromEpochMilliseconds(Date.now() - 2 * 60 * 60 * 1000);
-    await updateMany(
+    await updateRows(
       stack.db,
       exportJobsTable,
       { status: EXPORT_JOB_STATUS.Running, startedAt: twoHoursAgo },
@@ -250,7 +245,7 @@ describe("runExportJobs :: stale-detection", () => {
     const jobId = await seedPendingJob();
     const T = getTemporal();
     const justNow = T.Instant.fromEpochMilliseconds(Date.now() - 60 * 1000); // 1min ago
-    await updateMany(
+    await updateRows(
       stack.db,
       exportJobsTable,
       { status: EXPORT_JOB_STATUS.Running, startedAt: justNow },
@@ -285,7 +280,7 @@ describe("runExportJobs :: stale-detection", () => {
     // gesetzt + ZIP geschrieben. Worker dann gecrashed (kein done-flip).
     const provider = await buildProvider(tenantA);
     await provider.write(storageKey, new Uint8Array([1, 2, 3]));
-    await updateMany(
+    await updateRows(
       stack.db,
       exportJobsTable,
       {
@@ -327,7 +322,7 @@ describe("runExportJobs :: storage-cleanup", () => {
     const provider = await buildProvider(tenantA);
     await provider.write(storageKey, new Uint8Array([1, 2, 3]));
 
-    await updateMany(
+    await updateRows(
       stack.db,
       exportJobsTable,
       {
@@ -366,7 +361,7 @@ describe("runExportJobs :: storage-cleanup", () => {
     const provider = await buildProvider(tenantA);
     await provider.write(storageKey, new Uint8Array([4, 5, 6]));
 
-    await updateMany(
+    await updateRows(
       stack.db,
       exportJobsTable,
       {
@@ -470,7 +465,7 @@ describe("runExportJobs :: stale-detection profile-driven cutoff", () => {
     const jobId = await seedPendingJob();
     const T = getTemporal();
     const fortyFiveMinAgo = T.Instant.fromEpochMilliseconds(Date.now() - 45 * 60 * 1000);
-    await updateMany(
+    await updateRows(
       stack.db,
       exportJobsTable,
       { status: EXPORT_JOB_STATUS.Running, startedAt: fortyFiveMinAgo },
@@ -661,7 +656,7 @@ describe("runExportJobs :: Atom 4a download-tokens", () => {
     // (simuliert orphan-state nach Worker-crash).
     const provider = await buildProvider(tenantA);
     await provider.write(storageKey, new Uint8Array([99, 99, 99]));
-    await updateMany(
+    await updateRows(
       stack.db,
       exportJobsTable,
       {
@@ -1046,7 +1041,7 @@ describe("runExportJobs :: Atom 5 notification-callbacks", () => {
     // User-Row mit email=null seeden (override). Worker logged warn,
     // Callback wird NICHT gerufen, Worker-Run bleibt successful.
     await resetTestTables(stack.db, [userTable]);
-    await insertOne(stack.db, userTable, {
+    await seedRow(stack.db, userTable, {
       id: String(aliceUser.id),
       tenantId: tenantA,
       email: "" as string, // empty string — lookupUserEmail returnt null
@@ -1092,7 +1087,7 @@ describe("runExportJobs :: Atom 5 notification-callbacks", () => {
       tenantId: tenantA,
       roles: ["Member"],
     });
-    await insertOne(stack.db, userTable, {
+    await seedRow(stack.db, userTable, {
       id: String(bobUser.id),
       tenantId: tenantA,
       email: "bob@example.com",

package/src/user-data-rights/__tests__/run-forget-cleanup.integration.test.ts

@@ -16,7 +16,8 @@
 // der end-to-end-Default-Pfad (delete).
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { asRawClient, insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { JobContext } from "@cosmicdrift/kumiko-framework/engine";
 import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import {
   setupTestStack,
@@ -24,7 +25,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { resetTestTables, seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createDataRetentionFeature, tenantRetentionOverrideEntity } from "../../data-retention";
@@ -123,7 +124,7 @@ async function seedUser(
     displayName?: string;
   } = {},
 ): Promise<void> {
-  await insertOne(stack.db, userTable, {
+  await seedRow(stack.db, userTable, {
     id,
     tenantId: TENANT_SYSTEM,
     email: overrides.email ?? `user-${id}@example.com`,
@@ -289,7 +290,10 @@ describe("run-forget-cleanup :: registered cron (autonomous Art.17)", () => {
     await seedMembership(CRON_USER, TENANT_A);
 
     const jobCtx = { db: stack.db, registry: stack.registry };
-    await job?.handler({}, jobCtx as never);
+    // jobCtx is a deliberately minimal prod-context replica (missing
+    // systemUser/log/triggeredBy) — double-cast at this test boundary since
+    // the handler under test never touches those fields.
+    await job?.handler({}, jobCtx as unknown as JobContext);
 
     const row = await fetchUser(CRON_USER);
     expect(row?.status).toBe(USER_STATUS.Deleted);
@@ -616,7 +620,7 @@ describe("runForgetCleanup :: sendDeletionExecutedEmail callback (Atom 5b)", ()
     // einem vorigen Run schon anonymisiert hat aber status haengen blieb,
     // oder durch external Migration). Skip schuetzt vor crashing-callback
     // mit invaliden Args.
-    await insertOne(stack.db, userTable, {
+    await seedRow(stack.db, userTable, {
       id: ALICE_ID,
       tenantId: TENANT_SYSTEM,
       email: "",

package/src/user-data-rights/__tests__/run-user-export.integration.test.ts

@@ -15,7 +15,7 @@
 //     ueber Pseudo-Tenant.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { asRawClient, insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import {
   setupTestStack,
@@ -23,7 +23,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { resetTestTables, seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createDataRetentionFeature } from "../../data-retention";
@@ -99,7 +99,7 @@ async function seedUser(
   id: string,
   overrides: { email?: string; displayName?: string; roles?: string } = {},
 ): Promise<void> {
-  await insertOne(stack.db, userTable, {
+  await seedRow(stack.db, userTable, {
     id,
     tenantId: TENANT_SYSTEM,
     email: overrides.email ?? `user-${id}@example.com`,

package/src/user-data-rights/handlers/download-attempt-list.query.ts

@@ -7,5 +7,5 @@ import { downloadAttemptEntity } from "../schema/download-attempt";
 export const downloadAttemptListQuery = defineEntityListHandler(
   "download-attempt",
   downloadAttemptEntity,
-  { access: { roles: access.systemAdmin } },
+  { access: { roles: access.systemAdmin }, crossTenant: true },
 );

package/src/user-data-rights/handlers/download-by-job.query.ts

@@ -63,13 +63,11 @@ export const downloadByJobQuery = defineQueryHandler({
     const userId = query.user.id;
     const jobId = query.payload.jobId;
     const tenantId = query.user.tenantId;
-    // IP aus dem request-scoped Kontext (von requestIdMiddleware aus
-    // x-forwarded-for befuellt) — server-trusted, anders als ein vom Client
-    // mitgeschickter Wert. UA steht nicht im RequestContext; der Audit-Row
-    // laesst sie null (best-effort, via requestId in den Server-Logs
-    // cross-referenzierbar).
+    // IP + UA aus dem request-scoped Kontext (von requestIdMiddleware
+    // befuellt) — server-trusted, anders als ein vom Client mitgeschickter
+    // Wert (603/2).
     const auditIp = requestContext.get()?.ip ?? null;
-    const auditUa: string | null = null;
+    const auditUa = requestContext.get()?.userAgent ?? null;
 
     // Step 1-2: job-lookup + cross-user-isolation
     // ctx.db.raw weil tenant-agnostisch — Alice in Tenant B sucht den

package/src/user-data-rights/handlers/export-job-detail.query.ts

@@ -4,4 +4,5 @@ import { exportJobEntity } from "../schema/export-job";
 // Detail fetch backing the read-only export-job inspector screen.
 export const exportJobDetailQuery = defineEntityDetailHandler("export-job", exportJobEntity, {
   access: { roles: access.systemAdmin },
+  crossTenant: true,
 });

package/src/user-data-rights/handlers/export-job-list.query.ts

@@ -5,4 +5,5 @@ import { exportJobEntity } from "../schema/export-job";
 // rows are created by the user's request-export flow, never through this handler.
 export const exportJobListQuery = defineEntityListHandler("export-job", exportJobEntity, {
   access: { roles: access.systemAdmin },
+  crossTenant: true,
 });