@cosmicdrift/kumiko-bundled-features 0.277.0 → 0.280.0

package/src/form-draft-user-data/__tests__/hooks-delete-failure.integration.test.ts

@@ -7,6 +7,7 @@
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -50,7 +51,12 @@ describe("formDraftDeleteHook — delete failure handling (#review-batch-fw-1)",
 
     await expect(
       formDraftDeleteHook(
-        { db: stack.db, registry: stack.registry, tenantId: bob.tenantId, userId: bob.id },
+        {
+          db: createTenantDb(stack.db, bob.tenantId, "tenant"),
+          registry: stack.registry,
+          tenantId: bob.tenantId,
+          userId: bob.id,
+        },
         "delete",
       ),
     ).resolves.toBeUndefined();

package/src/form-draft-user-data/__tests__/hooks.integration.test.ts

@@ -5,6 +5,7 @@
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -52,7 +53,7 @@ describe("formDraftExportHook", () => {
     );
 
     const snippet = await formDraftExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, owner.tenantId, "tenant"),
       registry: stack.registry,
       tenantId: owner.tenantId,
       userId: owner.id,
@@ -88,7 +89,7 @@ describe("formDraftExportHook", () => {
     );
 
     const snippet = await formDraftExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, tenantATestTenantId, "tenant"),
       registry: stack.registry,
       tenantId: tenantATestTenantId,
       userId: sameIdTenantA.id,
@@ -101,7 +102,7 @@ describe("formDraftExportHook", () => {
   test("returns null when the user saved no drafts", async () => {
     const lurker = createTestUser({ id: 3, roles: ["TenantMember"] });
     const snippet = await formDraftExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, lurker.tenantId, "tenant"),
       registry: stack.registry,
       tenantId: lurker.tenantId,
       userId: lurker.id,
@@ -126,7 +127,12 @@ describe("formDraftDeleteHook", () => {
     );
 
     await formDraftDeleteHook(
-      { db: stack.db, registry: stack.registry, tenantId: alice.tenantId, userId: alice.id },
+      {
+        db: createTenantDb(stack.db, alice.tenantId, "tenant"),
+        registry: stack.registry,
+        tenantId: alice.tenantId,
+        userId: alice.id,
+      },
       "delete",
     );
 
@@ -138,7 +144,12 @@ describe("formDraftDeleteHook", () => {
     const lurker = createTestUser({ id: 13, roles: ["TenantMember"] });
     await expect(
       formDraftDeleteHook(
-        { db: stack.db, registry: stack.registry, tenantId: lurker.tenantId, userId: lurker.id },
+        {
+          db: createTenantDb(stack.db, lurker.tenantId, "tenant"),
+          registry: stack.registry,
+          tenantId: lurker.tenantId,
+          userId: lurker.id,
+        },
         "delete",
       ),
     ).resolves.toBeUndefined();

package/src/form-draft-user-data/hooks.ts

@@ -3,8 +3,6 @@
 // consumers without the user-data-rights pipeline don't pull a hard
 // dependency.
 
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
   type UserDataDeleteHook,
@@ -13,7 +11,7 @@ import {
 import { formDraftExecutor, formDraftTable } from "../form-draft";
 
 export const formDraftExportHook: UserDataExportHook = async (ctx) => {
-  const rows = await selectMany<Record<string, unknown>>(ctx.db, formDraftTable, {
+  const rows = await ctx.db.selectMany(formDraftTable, {
     tenantId: ctx.tenantId,
     ownerId: ctx.userId,
   });
@@ -37,15 +35,14 @@ export const formDraftExportHook: UserDataExportHook = async (ctx) => {
 // owners' drafts, tenant model doesn't matter here (unlike folders' single-
 // user gating: a form-draft row always has exactly one owner already).
 export const formDraftDeleteHook: UserDataDeleteHook = async (ctx) => {
-  const rows = await selectMany<{ id: string }>(ctx.db, formDraftTable, {
+  const rows = await ctx.db.selectMany<{ id: string }>(formDraftTable, {
     tenantId: ctx.tenantId,
     ownerId: ctx.userId,
   });
   const systemUser = createSystemUser(ctx.tenantId);
-  const tdb = createTenantDb(ctx.db, ctx.tenantId, "system");
   const failures: string[] = [];
   for (const row of rows) {
-    const result = await formDraftExecutor.delete({ id: row.id }, systemUser, tdb);
+    const result = await formDraftExecutor.delete({ id: row.id }, systemUser, ctx.db);
     if (!result.isSuccess) {
       failures.push(`${row.id}: ${result.error.message}`);
     }

package/src/notes-history-user-data/__tests__/hooks.integration.test.ts

@@ -5,6 +5,7 @@
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { createEntity, createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -78,7 +79,7 @@ describe("noteEntryExportHook", () => {
     );
 
     const snippet = await noteEntryExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, author.tenantId, "tenant"),
       registry: stack.registry,
       tenantId: author.tenantId,
       userId: author.id,
@@ -95,7 +96,7 @@ describe("noteEntryExportHook", () => {
   test("returns null when the user authored no notes", async () => {
     const lurker = createTestUser({ id: 3, roles: ["TenantMember"] });
     const snippet = await noteEntryExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, lurker.tenantId, "tenant"),
       registry: stack.registry,
       tenantId: lurker.tenantId,
       userId: lurker.id,
@@ -107,7 +108,12 @@ describe("noteEntryExportHook", () => {
 describe("noteEntryDeleteHook", () => {
   test("is a no-op — resolves without throwing", async () => {
     const result = await noteEntryDeleteHook(
-      { db: stack.db, registry: stack.registry, tenantId: author.tenantId, userId: author.id },
+      {
+        db: createTenantDb(stack.db, author.tenantId, "tenant"),
+        registry: stack.registry,
+        tenantId: author.tenantId,
+        userId: author.id,
+      },
       "delete",
     );
     expect(result).toBeUndefined();

package/src/notes-history-user-data/hooks.ts

@@ -4,7 +4,6 @@
 // dependency. Mirrors job-run/delivery-attempt (user-data-rights-defaults):
 // export-only, erasure via crypto-shredding.
 
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms } from "@cosmicdrift/kumiko-framework/crypto";
 import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
 import { resolveRetentionPolicyForTenant } from "../data-retention";
@@ -14,7 +13,7 @@ import { policyToStrategy } from "../user-data-rights";
 // note-entry has no per-tenant scope quirk (unlike folders) — it's genuinely
 // per-user content, so the export filters by authorId directly.
 export const noteEntryExportHook: UserDataExportHook = async (ctx) => {
-  const rows = await selectMany<Record<string, unknown>>(ctx.db, noteEntryTable, {
+  const rows = await ctx.db.selectMany(noteEntryTable, {
     authorId: ctx.userId,
   });
   if (rows.length === 0) return null;
@@ -55,7 +54,7 @@ export const noteEntryDeleteHook: UserDataDeleteHook = async (ctx) => {
   // skip: no KMS adapter mounted — record-owned fields stay plaintext framework-wide, forget is a true no-op
   if (!kms) return;
 
-  const mentions = await selectMany<{ noteId: string }>(ctx.db, noteMentionTable, {
+  const mentions = await ctx.db.selectMany<{ noteId: string }>(noteMentionTable, {
     subjectId: ctx.userId,
   });
   // skip: no note-mention rows for this user — nothing structurally reaches this user's data to shred
@@ -63,7 +62,7 @@ export const noteEntryDeleteHook: UserDataDeleteHook = async (ctx) => {
 
   const noteIds = new Set(mentions.map((m) => m.noteId));
   for (const noteId of noteIds) {
-    const note = await fetchOne<{ entityType: string }>(ctx.db, noteEntryTable, { id: noteId });
+    const note = await ctx.db.fetchOne<{ entityType: string }>(noteEntryTable, { id: noteId });
     // Defensive: append-only rows are never hard-deleted, so this shouldn't
     // happen — but a missing host means no retention policy to consult.
     if (!note) continue;

package/src/personal-access-tokens/handlers/create.write.ts

@@ -30,6 +30,7 @@ export type CreatePatOptions = {
   ) => Promise<PatMfaVerifyResult>;
 };
 
+// @wrapper-known error-helper
 function reauthFailed() {
   return writeFailure(
     new UnprocessableError(PatErrors.reauthRequired, {

package/src/template-resolver-user-data/hooks.ts

@@ -3,7 +3,6 @@
 // so apps without the user-data-rights pipeline don't pull a hard dependency.
 // Mirrors notes-history-user-data: export-only, erasure via crypto-shredding.
 
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
 import { userContentEntriesTable } from "../template-resolver";
 
@@ -11,7 +10,7 @@ import { userContentEntriesTable } from "../template-resolver";
 // scoping comes from the tenant-scoped ctx.db; a user who belongs to two
 // tenants gets each tenant's entries from that tenant's forget run.
 export const userContentExportHook: UserDataExportHook = async (ctx) => {
-  const rows = await selectMany<Record<string, unknown>>(ctx.db, userContentEntriesTable, {
+  const rows = await ctx.db.selectMany(userContentEntriesTable, {
     ownerId: ctx.userId,
   });
   if (rows.length === 0) return null;

package/src/tenant-lifecycle/feature.ts

@@ -132,6 +132,8 @@ export function createTenantLifecycleFeature(): FeatureDefinition {
           now: T.Now.instant(),
           log: (message) => ctx.log?.warn(message),
           fileProviderResolver: ctx._fileProviderResolver,
+          escapeHatchAuditSink: ctx._escapeHatchAuditSink,
+          actor: ctx.systemUser.id,
         });
       },
     });

package/src/tenant-lifecycle/run-tenant-destroy.ts

@@ -3,6 +3,7 @@ import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
+  type EscapeHatchAuditSink,
   type Registry,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
@@ -216,6 +217,8 @@ export async function runNextDestructionStage(args: {
   readonly tenantId: TenantId;
   readonly log?: (message: string) => void;
   readonly fileProviderResolver?: FileProviderResolver;
+  readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
+  readonly actor?: string;
 }): Promise<{ readonly done: boolean; readonly error?: string; readonly halted?: boolean }> {
   const events = await loadAggregate(args.db, args.tenantId, args.tenantId);
   const { completed, abandoned, attemptsByStage } = replayStageState(events);
@@ -238,6 +241,8 @@ export async function runNextDestructionStage(args: {
     tenantId: args.tenantId,
     log: args.log,
     fileProviderResolver: args.fileProviderResolver,
+    escapeHatchAuditSink: args.escapeHatchAuditSink,
+    actor: args.actor,
   };
 
   let version = lastEventVersion(events);
@@ -304,6 +309,8 @@ export async function runTenantDestructionSweep(args: {
   readonly now?: Temporal.Instant;
   readonly log?: (message: string) => void;
   readonly fileProviderResolver?: FileProviderResolver;
+  readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
+  readonly actor?: string;
 }): Promise<{ readonly triggered: number; readonly advanced: number }> {
   const T = getTemporal();
   const now = args.now ?? T.Now.instant();
@@ -353,6 +360,8 @@ export async function runTenantDestructionSweep(args: {
         tenantId: row.id as TenantId,
         log: args.log,
         fileProviderResolver: args.fileProviderResolver,
+        escapeHatchAuditSink: args.escapeHatchAuditSink,
+        actor: args.actor,
       });
       if (!result.error && !result.halted) advanced++;
     } catch (err) {

package/src/tenant-lifecycle/stages.ts

@@ -7,15 +7,19 @@ import {
 } from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
+  type EscapeHatchAuditSink,
   EXT_EXTERNAL_RESOURCE,
   EXT_INFRA_RESOURCE,
   EXT_SEARCH_ADAPTER,
   EXT_STORAGE_PROVIDER,
   EXT_TENANT_DATA,
+  extensionUsageEscapeHatchReason,
   type Registry,
+  type TenantDataHookCtx,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import type { FileProviderResolver } from "@cosmicdrift/kumiko-framework/files";
+import { createEscapeHatchReporter } from "@cosmicdrift/kumiko-framework/pipeline";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import {
   tenantEntity,
@@ -35,6 +39,11 @@ export type DestructionStageCtx = {
   // "destroyTenant" hooks) — undefined when no file-provider is wired,
   // which those hooks must treat as "nothing to clean up", not an error.
   readonly fileProviderResolver?: FileProviderResolver;
+  // fw#2914 — sourced from the owning job's ctx (_escapeHatchAuditSink,
+  // systemUser.id); runTenantDataHooks uses them to attribute+audit any
+  // EXT_TENANT_DATA usage's declared escapeHatch.
+  readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
+  readonly actor?: string;
 };
 
 export type DestructionStage = {
@@ -73,10 +82,25 @@ async function runTenantDataHooks(ctx: DestructionStageCtx): Promise<void> {
   const usages = ctx.registry.getExtensionUsages(EXT_TENANT_DATA);
   for (const usage of usages) {
     const destroy = usage.options?.["destroy"] as
-      | ((ctx: DestructionStageCtx) => Promise<void>)
+      | ((hookCtx: TenantDataHookCtx) => Promise<void>)
       | undefined;
     if (!destroy) continue;
-    await destroy(ctx);
+    const reason = extensionUsageEscapeHatchReason(usage);
+    const report = createEscapeHatchReporter({
+      handler: `${EXT_TENANT_DATA}:${usage.entityName}`,
+      tenantId: ctx.tenantId,
+      actor: ctx.actor ?? "system",
+      sink: ctx.escapeHatchAuditSink,
+    });
+    const hookCtx: TenantDataHookCtx = {
+      db: createTenantDb(ctx.db, ctx.tenantId, "tenant", undefined, undefined, undefined, {
+        unsafeRaw: reason !== undefined ? { reason } : undefined,
+        report,
+      }),
+      registry: ctx.registry,
+      tenantId: ctx.tenantId,
+    };
+    await destroy(hookCtx);
   }
 }
 

package/src/tier-engine/__tests__/tier-resolver.integration.test.ts

@@ -0,0 +1,138 @@
+// createTierResolver (fw#2854): resolveTier/resolveTierCaps take only a
+// TenantDb — the tenant comes from db.tenantId, so a caller can't request a
+// foreign tenant's tier. Proves defaultTier for an unassigned tenant, the
+// assigned tier for an assigned one, and the same behavior end-to-end
+// through a TenantAdmin-only query handler with no escapeHatch.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { configValuesTable } from "@cosmicdrift/kumiko-bundled-features/config";
+import { tenantSecretsTable } from "@cosmicdrift/kumiko-bundled-features/secrets";
+import { tenantMembershipsTable, tenantTable } from "@cosmicdrift/kumiko-bundled-features/tenant";
+import { userTable } from "@cosmicdrift/kumiko-bundled-features/user";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { buildEntityTable, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { defineFeature, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";
+import { z } from "zod";
+import { tierAssignmentEntity } from "../entity";
+import { tierEngineFeature } from "../feature";
+import { createTierResolver } from "../tier-resolver";
+
+type TestCaps = { readonly maxItems: number };
+type TestTier = "free" | "pro";
+
+function isTestTierName(value: string): value is TestTier {
+  return value === "free" || value === "pro";
+}
+
+function capsForTier(tier: TestTier): TestCaps {
+  return tier === "pro" ? { maxItems: 5 } : { maxItems: 1 };
+}
+
+const { resolveTier, resolveTierCaps } = createTierResolver<TestTier, TestCaps>({
+  capsForTier,
+  isTierName: isTestTierName,
+  defaultTier: "free",
+});
+
+const RESOLVED_CAPS_QN = "resolver-probe:query:resolved-caps";
+const resolverProbeFeature = defineFeature("resolver-probe", (r) => {
+  r.queryHandler({
+    name: "resolved-caps",
+    schema: z.object({}),
+    access: { roles: ["TenantAdmin"] },
+    handler: async (_query, ctx) => resolveTierCaps(ctx.db),
+  });
+});
+
+const features = composeFeatures([tierEngineFeature, resolverProbeFeature], {
+  includeBundled: true,
+});
+
+// Same underlying table createTierResolver builds internally — pushed here
+// so the schema exists before the write-handler + resolver read it.
+const tierAssignmentTable = buildEntityTable("tier-assignment", tierAssignmentEntity);
+
+let stack: TestStack;
+const tenantA = "00000000-0000-4000-8000-0000000000c1" as TenantId;
+const tenantB = "00000000-0000-4000-8000-0000000000c2" as TenantId;
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features });
+  await unsafePushTables(stack.db, {
+    config_values: configValuesTable,
+    users: userTable,
+    tenants: tenantTable,
+    tenant_memberships: tenantMembershipsTable,
+    tenant_secrets: tenantSecretsTable,
+    tier_assignments: tierAssignmentTable,
+  });
+});
+
+afterAll(async () => stack?.cleanup());
+
+beforeEach(async () => {
+  await asRawClient(stack.db).unsafe(`TRUNCATE read_tier_assignments RESTART IDENTITY CASCADE`);
+});
+
+function sysAdminFor(tenantId: TenantId) {
+  return createTestUser({ id: `sys-${tenantId}`, tenantId, roles: ["SystemAdmin", "TenantAdmin"] });
+}
+
+function tenantAdminOnlyFor(tenantId: TenantId) {
+  return createTestUser({ id: `admin-${tenantId}`, tenantId, roles: ["TenantAdmin"] });
+}
+
+async function assignTier(tenantId: TenantId, tier: TestTier): Promise<void> {
+  await stack.http.writeOk(
+    "tier-engine:write:tier-assignment:create",
+    { tier },
+    sysAdminFor(tenantId),
+  );
+}
+
+describe("createTierResolver — resolveTier/resolveTierCaps", () => {
+  test("unassigned tenant B resolves to defaultTier, not tenant A's assigned tier", async () => {
+    await assignTier(tenantA, "pro");
+
+    const tierA = await resolveTier(createTenantDb(stack.db, tenantA));
+    expect(tierA).toBe("pro");
+
+    const tierB = await resolveTier(createTenantDb(stack.db, tenantB));
+    expect(tierB).toBe("free");
+  });
+
+  test("resolveTierCaps maps the resolved tier via capsForTier", async () => {
+    await assignTier(tenantA, "pro");
+
+    const capsA = await resolveTierCaps(createTenantDb(stack.db, tenantA));
+    expect(capsA).toEqual({ maxItems: 5 });
+
+    const capsB = await resolveTierCaps(createTenantDb(stack.db, tenantB));
+    expect(capsB).toEqual({ maxItems: 1 });
+  });
+
+  test("end-to-end via a TenantAdmin-only query handler (no escapeHatch)", async () => {
+    await assignTier(tenantA, "pro");
+
+    const capsA = await stack.http.queryOk<TestCaps>(
+      RESOLVED_CAPS_QN,
+      {},
+      tenantAdminOnlyFor(tenantA),
+    );
+    expect(capsA).toEqual({ maxItems: 5 });
+
+    const capsB = await stack.http.queryOk<TestCaps>(
+      RESOLVED_CAPS_QN,
+      {},
+      tenantAdminOnlyFor(tenantB),
+    );
+    expect(capsB).toEqual({ maxItems: 1 });
+  });
+});

package/src/tier-engine/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.278.0",
+    "type": "breaking",
+    "title": "createTierResolver's resolveTier/resolveTierCaps take only a TenantDb — no separate tenantId argument (fw#2854).",
+    "detail": "`resolveTier(db)` and `resolveTierCaps(db)` (from `createTierResolver`) now read the tenant from `db.tenantId` instead of taking a second `tenantId` parameter, so a caller can no longer pass a `TenantDb` for one tenant alongside a different `tenantId` and resolve a foreign tenant's tier.",
+    "migration": "`resolveTier(ctx.db.raw|runner, tenantId)` → `resolveTier(ctx.db)` (same for `resolveTierCaps`). Outside a handler: `resolveTier(createTenantDb(runner, tenantId))`."
+  },
   {
     "version": "0.241.0",
     "type": "breaking",

package/src/tier-engine/tier-resolver.ts

@@ -3,8 +3,7 @@
 // only per-app variables were the TierName union and its caps/defaults, so
 // both are now factory parameters.
 
-import { buildEntityTable, type DbRunner, fetchOne } from "@cosmicdrift/kumiko-framework/db";
-import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { buildEntityTable, type TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { tierAssignmentEntity } from "./entity";
 
 export type TierResolverDeps<TTier extends string, TCaps> = {
@@ -18,14 +17,16 @@ export function createTierResolver<TTier extends string, TCaps>(
 ) {
   const tierAssignmentTable = buildEntityTable("tier-assignment", tierAssignmentEntity);
 
-  async function resolveTier(db: DbRunner, tenantId: TenantId): Promise<TTier> {
-    const row = await fetchOne<{ tier?: unknown }>(db, tierAssignmentTable, { tenantId });
+  async function resolveTier(db: TenantDb): Promise<TTier> {
+    const row = await db.fetchOne<{ tier?: unknown }>(tierAssignmentTable, {
+      tenantId: db.tenantId,
+    });
     const tier = row?.tier;
     return typeof tier === "string" && deps.isTierName(tier) ? tier : deps.defaultTier;
   }
 
-  async function resolveTierCaps(db: DbRunner, tenantId: TenantId): Promise<TCaps> {
-    return deps.capsForTier(await resolveTier(db, tenantId));
+  async function resolveTierCaps(db: TenantDb): Promise<TCaps> {
+    return deps.capsForTier(await resolveTier(db));
   }
 
   return { tierAssignmentTable, resolveTier, resolveTierCaps };

package/src/user-data-rights/__tests__/cross-data-matrix.integration.test.ts

@@ -19,6 +19,7 @@ import { defineUnmanagedTable } from "@cosmicdrift/kumiko-framework/db";
 import {
   defineFeature,
   EXT_USER_DATA,
+  SYSTEM_TENANT_ID,
   type UserDataDeleteHook,
   type UserDataExportHook,
 } from "@cosmicdrift/kumiko-framework/engine";
@@ -49,7 +50,7 @@ let stack: TestStack;
 
 const TENANT_A = "00000000-0000-4000-8000-00000000000a";
 const TENANT_B = "00000000-0000-4000-8000-00000000000b";
-const TENANT_SYSTEM = "00000000-0000-4000-8000-000000000001";
+const TENANT_SYSTEM = SYSTEM_TENANT_ID;
 
 function uuid(suffix: number): string {
   return `cccccccc-cccc-4ccc-8ccc-${suffix.toString(16).padStart(12, "0")}`;
@@ -77,20 +78,10 @@ const testNotesTable = defineUnmanagedTable({
 // Stellvertretend fuer App-spezifische Entities (Chat-Message, Blog-Post
 // etc.), die ueber EXT_USER_DATA sauber in die Pipeline integrieren.
 const exportNotes: UserDataExportHook = async (ctx) => {
-  const result = await asRawClient(ctx.db).unsafe(
-    `
-    SELECT id, title, body
-    FROM test_notes
-    WHERE tenant_id = $1 AND author_id = $2
-  `,
-    [ctx.tenantId, ctx.userId],
+  const rows = await ctx.db.selectMany<{ id: string; title: string; body: string }>(
+    testNotesTable,
+    { tenantId: ctx.tenantId, authorId: ctx.userId },
   );
-  // biome-ignore lint/suspicious/noExplicitAny: drizzle execute typing
-  const rows = ((result as any).rows ?? result) as Array<{
-    id: string;
-    title: string;
-    body: string;
-  }>;
   if (rows.length === 0) return null;
   return {
     entity: "note",