@cosmicdrift/kumiko-bundled-features 0.277.0 → 0.280.0

package/src/user-data-rights/run-export-jobs.ts

@@ -49,7 +49,11 @@ import { addDurationSpec } from "@cosmicdrift/kumiko-framework/compliance";
 import { PII_ERASED_SENTINEL } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection, DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
-import type { Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type {
+  EscapeHatchAuditSink,
+  Registry,
+  TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { createSystemUser } from "@cosmicdrift/kumiko-framework/engine";
 import {
   createZipStream,
@@ -155,6 +159,11 @@ export interface RunExportJobsArgs {
    *  a URL fragment (not a query param — see issue #1271) and passes that
    *  Callback durch. Required wenn sendExportReadyEmail gesetzt. */
   readonly appExportDownloadUrl?: string;
+
+  // fw#2914 — sourced from the owning job's ctx (_escapeHatchAuditSink,
+  // systemUser.id); threaded into runUserExport's per-hook TenantDb.
+  readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
+  readonly actor?: string;
 }
 
 export interface ExportJobError {
@@ -219,6 +228,8 @@ export async function runExportJobs(args: RunExportJobsArgs): Promise<RunExportJ
       buildStorageProvider,
       now,
       job,
+      escapeHatchAuditSink: args.escapeHatchAuditSink,
+      actor: args.actor,
     });
     if (outcome.kind === "done") {
       completedJobIds.push(job.id);
@@ -337,6 +348,8 @@ async function processJob(args: {
   buildStorageProvider: (tenantId: TenantId) => Promise<FileStorageProvider>;
   now: Instant;
   job: JobRow;
+  escapeHatchAuditSink?: EscapeHatchAuditSink;
+  actor?: string;
 }): Promise<ProcessOutcome> {
   const { db, registry, buildStorageProvider, now, job } = args;
   const executor = createSystemUser(job.requestedFromTenantId);
@@ -381,6 +394,8 @@ async function processJob(args: {
       registry,
       userId: job.userId,
       now,
+      escapeHatchAuditSink: args.escapeHatchAuditSink,
+      actor: args.actor,
     });
 
     const profile = await resolveProfileForTenant({

package/src/user-data-rights/run-forget-cleanup.ts

@@ -39,14 +39,17 @@ import {
   subjectIdToKey,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import {
+  createTenantDb,
   type DbRunner,
   entityEventName,
   executeRawQuery,
   nullBlindIndexesForSubject,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
+  type EscapeHatchAuditSink,
   EXT_USER_DATA,
   EXT_USER_DATA_ORDER,
+  extensionUsageEscapeHatchReason,
   type Registry,
   type TenantId,
   type TenantUserModel,
@@ -54,6 +57,7 @@ import {
   type UserDataDeleteStrategy,
   type UserDataStorageProvider,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { createEscapeHatchReporter } from "@cosmicdrift/kumiko-framework/pipeline";
 import {
   purgeSearchDocumentsForSubject,
   type SearchAdapter,
@@ -140,6 +144,12 @@ export interface RunForgetCleanupArgs {
    * (no tenant-scoped erasure).
    */
   readonly tenantModel?: TenantUserModel;
+
+  // fw#2914 — sourced from the owning job's ctx (_escapeHatchAuditSink,
+  // systemUser.id); attributes+audits any EXT_USER_DATA usage's declared
+  // escapeHatch when its delete hook calls ctx.db.unsafeRaw(reason).
+  readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
+  readonly actor?: string;
 }
 
 export interface ForgetCleanupError {
@@ -184,6 +194,26 @@ interface HookEntry {
   /** Lower runs first. Owner-column-preserving redaction declares a negative
    * order so it precedes owner-nulling hooks on the same entity (see sort below). */
   readonly order: number;
+  readonly escapeHatchReason: string | undefined;
+}
+
+function buildHookDb(
+  db: DbRunner,
+  tenantId: TenantId,
+  entry: HookEntry,
+  args: { readonly escapeHatchAuditSink?: EscapeHatchAuditSink; readonly actor?: string },
+) {
+  const report = createEscapeHatchReporter({
+    handler: `${EXT_USER_DATA}:${entry.entityName}`,
+    tenantId,
+    actor: args.actor ?? "system",
+    sink: args.escapeHatchAuditSink,
+  });
+  return createTenantDb(db, tenantId, "tenant", undefined, undefined, undefined, {
+    unsafeRaw:
+      entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
+    report,
+  });
 }
 
 // EXT_USER_DATA delete-hooks default here; a hook that redacts data keyed on an
@@ -226,7 +256,12 @@ export async function runForgetCleanup(
       const opts = (u.options ?? {}) as { delete?: UserDataDeleteHook; order?: number }; // @cast-boundary engine-payload
       if (!opts.delete) return null;
       const order = typeof opts.order === "number" ? opts.order : HOOK_ORDER_DEFAULT;
-      return { entityName: u.entityName, deleteHook: opts.delete, order };
+      return {
+        entityName: u.entityName,
+        deleteHook: opts.delete,
+        order,
+        escapeHatchReason: extensionUsageEscapeHatchReason(u),
+      };
     })
     .filter((x): x is HookEntry => x !== null)
     // Order ascending. Array.sort is ES2019-stable, so equal orders keep
@@ -252,6 +287,8 @@ export async function runForgetCleanup(
       appTenantModel,
       kms,
       searchAdapter: args.searchAdapter,
+      escapeHatchAuditSink: args.escapeHatchAuditSink,
+      actor: args.actor,
     });
     hookCallsAttempted += userResult.hookCallsAttempted;
     errors.push(...userResult.errors);
@@ -316,6 +353,8 @@ async function processUser(args: {
   appTenantModel: TenantUserModel;
   kms?: KmsAdapter;
   searchAdapter?: SearchAdapter;
+  escapeHatchAuditSink?: EscapeHatchAuditSink;
+  actor?: string;
 }): Promise<ProcessUserResult> {
   const { db, registry, userId, hookEntries, buildStorageProvider, appTenantModel, kms } = args;
   const errors: ForgetCleanupError[] = [];
@@ -404,7 +443,10 @@ async function processUser(args: {
           hookCallsAttempted++;
           const hookResult = await entry.deleteHook(
             {
-              db: tx,
+              db: buildHookDb(tx, tenantId, entry, {
+                escapeHatchAuditSink: args.escapeHatchAuditSink,
+                actor: args.actor,
+              }),
               registry,
               tenantId,
               userId,

package/src/user-data-rights/run-user-export.ts

@@ -30,15 +30,19 @@ import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import {
   collectEncryptedFieldNames,
   configuredEntityFieldEncryption,
+  createTenantDb,
   decryptEntityFieldValues,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
+  type EscapeHatchAuditSink,
   EXT_USER_DATA,
+  extensionUsageEscapeHatchReason,
   type Registry,
   type TenantId,
   type UserDataExportHook,
   type UserDataExportSnippet,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { createEscapeHatchReporter } from "@cosmicdrift/kumiko-framework/pipeline";
 import type { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { tenantMembershipsTable } from "../tenant";
 import { buildFileRefZipPath } from "./zip-path";
@@ -50,6 +54,11 @@ export interface RunUserExportArgs {
   readonly registry: Registry;
   readonly userId: string;
   readonly now: Instant;
+  // fw#2914 — sourced from the owning job's ctx (_escapeHatchAuditSink,
+  // systemUser.id); attributes+audits any EXT_USER_DATA usage's declared
+  // escapeHatch when its export hook calls ctx.db.unsafeRaw(reason).
+  readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
+  readonly actor?: string;
 }
 
 export interface UserExportFileRef {
@@ -90,6 +99,26 @@ export interface UserExportBundle {
 interface HookEntry {
   readonly entityName: string;
   readonly exportHook: UserDataExportHook;
+  readonly escapeHatchReason: string | undefined;
+}
+
+function buildHookDb(
+  db: DbRunner,
+  tenantId: TenantId,
+  entry: HookEntry,
+  args: Pick<RunUserExportArgs, "escapeHatchAuditSink" | "actor">,
+) {
+  const report = createEscapeHatchReporter({
+    handler: `${EXT_USER_DATA}:${entry.entityName}`,
+    tenantId,
+    actor: args.actor ?? "system",
+    sink: args.escapeHatchAuditSink,
+  });
+  return createTenantDb(db, tenantId, "tenant", undefined, undefined, undefined, {
+    unsafeRaw:
+      entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
+    report,
+  });
 }
 
 /**
@@ -137,7 +166,13 @@ export async function runUserExport(args: RunUserExportArgs): Promise<UserExport
   const hookEntries: HookEntry[] = usages
     .map((u): HookEntry | null => {
       const opts = (u.options ?? {}) as { export?: UserDataExportHook }; // @cast-boundary engine-payload
-      return opts.export ? { entityName: u.entityName, exportHook: opts.export } : null;
+      return opts.export
+        ? {
+            entityName: u.entityName,
+            exportHook: opts.export,
+            escapeHatchReason: extensionUsageEscapeHatchReason(u),
+          }
+        : null;
     })
     .filter((x): x is HookEntry => x !== null);
 
@@ -147,7 +182,12 @@ export async function runUserExport(args: RunUserExportArgs): Promise<UserExport
   for (const tenantId of tenantList) {
     const entities: UserDataExportSnippet[] = [];
     for (const entry of hookEntries) {
-      const rawSnippet = await entry.exportHook({ db, registry, tenantId, userId });
+      const rawSnippet = await entry.exportHook({
+        db: buildHookDb(db, tenantId, entry, args),
+        registry,
+        tenantId,
+        userId,
+      });
       if (rawSnippet === null) continue;
       const snippet = await decryptSnippetFields(registry, entry.entityName, rawSnippet);
       entities.push(snippet);
@@ -181,7 +221,7 @@ export async function runUserExport(args: RunUserExportArgs): Promise<UserExport
     const orphanEntities: UserDataExportSnippet[] = [];
     for (const entry of hookEntries) {
       const rawSnippet = await entry.exportHook({
-        db,
+        db: buildHookDb(db, SYSTEM_TENANT_ID_FOR_ORPHANS, entry, args),
         registry,
         tenantId: SYSTEM_TENANT_ID_FOR_ORPHANS,
         userId,

package/src/user-data-rights-defaults/__tests__/bundled-entities.userdata-hooks.integration.test.ts

@@ -12,6 +12,8 @@
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
   type TestStack,
@@ -117,7 +119,7 @@ function uuid(suffix: number): string {
 
 function ctx(userId: string, overrides: Record<string, unknown> = {}) {
   return {
-    db: full.db,
+    db: createTenantDb(full.db, TENANT_A, "tenant"),
     registry: full.registry,
     tenantId: TENANT_A,
     userId,
@@ -132,10 +134,9 @@ async function rawSelect(sql: string, params: unknown[]) {
 }
 
 async function seedUser(id: string): Promise<void> {
-  const SYSTEM_TENANT = "00000000-0000-4000-8000-000000000001";
   await seedRow(full.db, userTable, {
     id,
-    tenantId: SYSTEM_TENANT,
+    tenantId: SYSTEM_TENANT_ID,
     email: `user-${id}@example.com`,
     passwordHash: "hashed-password",
     displayName: `User ${id}`,
@@ -404,11 +405,11 @@ describe("job-run userData-hooks (#799)", () => {
       `INSERT INTO store_job_runs
          (id, tenant_id, job_name, bull_job_id, status, payload, attempt, started_at, triggered_by_id)
        VALUES ($1::uuid, $2, 'app:job:export', $3, 'completed', '{"scope":"mine"}', 1, now(), $4)`,
-      [id, TENANT_A, `bull-${id}`, triggeredById],
+      [id, SYSTEM_TENANT_ID, `bull-${id}`, triggeredById],
     );
   }
 
-  test("export filters by triggeredById only (system-tenant rows)", async () => {
+  test("export filters by triggeredById only (rows live on SYSTEM_TENANT_ID, ctx bound to TENANT_A)", async () => {
     await seedRun(uuid(70), "jr-user-1");
     await seedRun(uuid(71), "jr-user-2");
     await seedRun(uuid(72), null);
@@ -428,7 +429,7 @@ describe("job-run userData-hooks (#799)", () => {
 describe("Presence-Gating: Source-Feature nicht gemountet → null/no-op statt Crash", () => {
   test("alle gegateten Hooks no-open auf dem Minimal-Stack", async () => {
     const minCtx = {
-      db: minimal.db,
+      db: createTenantDb(minimal.db, TENANT_A, "tenant"),
       registry: minimal.registry,
       tenantId: TENANT_A,
       userId: "any-user",

package/src/user-data-rights-defaults/__tests__/user-data-rights-defaults.integration.test.ts

@@ -13,7 +13,9 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { variantSuffix } from "@cosmicdrift/kumiko-framework/derivatives";
+import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import {
   createInMemoryFileProvider,
   deriveKey,
@@ -87,10 +89,9 @@ async function seedUser(id: string, overrides: Record<string, unknown> = {}): Pr
   // user-Entity ist tenant-agnostisch im Domain-Sinn, aber das DB-
   // Schema hat tenant_id-Spalte automatisch (Framework-Default).
   // Pragmatisch: SYSTEM_TENANT_ID fuer User-Rows in Tests.
-  const SYSTEM_TENANT = "00000000-0000-4000-8000-000000000001";
   await seedRow(stack.db, userTable, {
     id,
-    tenantId: SYSTEM_TENANT,
+    tenantId: SYSTEM_TENANT_ID,
     email: `user-${id}@example.com`,
     passwordHash: "hashed-password",
     displayName: `User ${id}`,
@@ -168,7 +169,7 @@ describe("S2.H1 :: userExportHook", () => {
     await seedUser(uuid(1001), { displayName: "Marc" });
 
     const result = await userExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, TENANT_A, "tenant"),
       registry: stack.registry,
       tenantId: TENANT_A,
       userId: uuid(1001),
@@ -189,7 +190,7 @@ describe("S2.H1 :: userExportHook", () => {
 
   test("returns null wenn User nicht existiert", async () => {
     const result = await userExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, TENANT_A, "tenant"),
       registry: stack.registry,
       tenantId: TENANT_A,
       userId: uuid(1002),
@@ -203,7 +204,12 @@ describe("S2.H1 :: userDeleteHook", () => {
     await seedUser(uuid(1003));
 
     await userDeleteHook(
-      { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: uuid(1003) },
+      {
+        db: createTenantDb(stack.db, TENANT_A, "tenant"),
+        registry: stack.registry,
+        tenantId: TENANT_A,
+        userId: uuid(1003),
+      },
       "delete",
     );
 
@@ -222,7 +228,12 @@ describe("S2.H1 :: userDeleteHook", () => {
     await seedUser(uuid(1004));
 
     await userDeleteHook(
-      { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: uuid(1004) },
+      {
+        db: createTenantDb(stack.db, TENANT_A, "tenant"),
+        registry: stack.registry,
+        tenantId: TENANT_A,
+        userId: uuid(1004),
+      },
       "anonymize",
     );
 
@@ -238,7 +249,12 @@ describe("S2.H1 :: userDeleteHook", () => {
     await seedUser(uuid(1005));
 
     await userDeleteHook(
-      { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: uuid(1005) },
+      {
+        db: createTenantDb(stack.db, TENANT_A, "tenant"),
+        registry: stack.registry,
+        tenantId: TENANT_A,
+        userId: uuid(1005),
+      },
       "delete",
     );
     const afterFirst = await fetchUser(uuid(1005));
@@ -247,7 +263,12 @@ describe("S2.H1 :: userDeleteHook", () => {
     // Zweiter Call: kein Crash + State unverändert
     await expect(
       userDeleteHook(
-        { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: uuid(1005) },
+        {
+          db: createTenantDb(stack.db, TENANT_A, "tenant"),
+          registry: stack.registry,
+          tenantId: TENANT_A,
+          userId: uuid(1005),
+        },
         "delete",
       ),
     ).resolves.toBeUndefined();
@@ -269,7 +290,7 @@ describe("S2.H2 :: fileRefExportHook", () => {
     await seedFileRef(uuid(102), TENANT_A, "user-files-1", "anschreiben.pdf");
 
     const result = await fileRefExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, TENANT_A, "tenant"),
       registry: stack.registry,
       tenantId: TENANT_A,
       userId: "user-files-1",
@@ -284,7 +305,7 @@ describe("S2.H2 :: fileRefExportHook", () => {
 
   test("returns null wenn User keine Files hat", async () => {
     const result = await fileRefExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, TENANT_A, "tenant"),
       registry: stack.registry,
       tenantId: TENANT_A,
       userId: "ghost-user-no-files",
@@ -299,7 +320,12 @@ describe("S2.H2 :: fileRefDeleteHook", () => {
     await seedFileRef(uuid(202), TENANT_A, "user-delete-files", "f2.pdf");
 
     await fileRefDeleteHook(
-      { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: "user-delete-files" },
+      {
+        db: createTenantDb(stack.db, TENANT_A, "tenant"),
+        registry: stack.registry,
+        tenantId: TENANT_A,
+        userId: "user-delete-files",
+      },
       "delete",
     );
 
@@ -311,7 +337,12 @@ describe("S2.H2 :: fileRefDeleteHook", () => {
     await seedFileRef(uuid(203), TENANT_A, "user-anon-files", "shared.pdf");
 
     await fileRefDeleteHook(
-      { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: "user-anon-files" },
+      {
+        db: createTenantDb(stack.db, TENANT_A, "tenant"),
+        registry: stack.registry,
+        tenantId: TENANT_A,
+        userId: "user-anon-files",
+      },
       "anonymize",
     );
 
@@ -329,7 +360,12 @@ describe("S2.H2 :: fileRefDeleteHook", () => {
 
     // Tenant A loescht alle Files von "shared-user"
     await fileRefDeleteHook(
-      { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: "shared-user" },
+      {
+        db: createTenantDb(stack.db, TENANT_A, "tenant"),
+        registry: stack.registry,
+        tenantId: TENANT_A,
+        userId: "shared-user",
+      },
       "delete",
     );
 
@@ -345,7 +381,12 @@ describe("S2.H2 :: fileRefDeleteHook", () => {
     await seedFileRef(uuid(401), TENANT_A, "user-idem-files", "f.pdf");
 
     await fileRefDeleteHook(
-      { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: "user-idem-files" },
+      {
+        db: createTenantDb(stack.db, TENANT_A, "tenant"),
+        registry: stack.registry,
+        tenantId: TENANT_A,
+        userId: "user-idem-files",
+      },
       "delete",
     );
     const afterFirst = await fetchFileRefs(TENANT_A, "user-idem-files");
@@ -354,7 +395,12 @@ describe("S2.H2 :: fileRefDeleteHook", () => {
     // Zweiter Call: kein Crash + State weiter 0 Files
     await expect(
       fileRefDeleteHook(
-        { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: "user-idem-files" },
+        {
+          db: createTenantDb(stack.db, TENANT_A, "tenant"),
+          registry: stack.registry,
+          tenantId: TENANT_A,
+          userId: "user-idem-files",
+        },
         "delete",
       ),
     ).resolves.toBeUndefined();
@@ -398,7 +444,7 @@ describe("S2.H2 :: fileRefDeleteHook — GDPR derivatives survive forget (issue
 
     await fileRefDeleteHook(
       {
-        db: stack.db,
+        db: createTenantDb(stack.db, TENANT_A, "tenant"),
         registry: stack.registry,
         tenantId: TENANT_A,
         userId,
@@ -428,7 +474,7 @@ describe("S2.H2 :: fileRefDeleteHook — GDPR derivatives survive forget (issue
 
     await fileRefDeleteHook(
       {
-        db: stack.db,
+        db: createTenantDb(stack.db, TENANT_A, "tenant"),
         registry: stack.registry,
         tenantId: TENANT_A,
         userId,
@@ -459,7 +505,7 @@ describe("S2.H2 :: fileRefDeleteHook — GDPR derivatives survive forget (issue
     await expect(
       fileRefDeleteHook(
         {
-          db: stack.db,
+          db: createTenantDb(stack.db, TENANT_A, "tenant"),
           registry: stack.registry,
           tenantId: TENANT_A,
           userId,

package/src/user-data-rights-defaults/hooks/api-token.userdata-hook.ts

@@ -1,4 +1,3 @@
-import { deleteMany, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
 import { apiTokenTable } from "../../personal-access-tokens";
 import { featureMounted } from "./feature-mounted";
@@ -11,7 +10,7 @@ import { featureMounted } from "./feature-mounted";
 
 export const apiTokenExportHook: UserDataExportHook = async (ctx) => {
   if (!featureMounted(ctx, "personal-access-tokens")) return null;
-  const rows = await selectMany<Record<string, unknown>>(ctx.db, apiTokenTable, {
+  const rows = await ctx.db.selectMany(apiTokenTable, {
     userId: ctx.userId,
     tenantId: ctx.tenantId,
   });
@@ -33,5 +32,5 @@ export const apiTokenExportHook: UserDataExportHook = async (ctx) => {
 export const apiTokenDeleteHook: UserDataDeleteHook = async (ctx) => {
   // skip: personal-access-tokens not mounted — its table doesn't exist, nothing to erase.
   if (!featureMounted(ctx, "personal-access-tokens")) return;
-  await deleteMany(ctx.db, apiTokenTable, { userId: ctx.userId, tenantId: ctx.tenantId });
+  await ctx.db.deleteMany(apiTokenTable, { userId: ctx.userId, tenantId: ctx.tenantId });
 };

package/src/user-data-rights-defaults/hooks/config-value.userdata-hook.ts

@@ -1,5 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
   type UserDataDeleteHook,
@@ -21,7 +20,7 @@ const crud = createEventStoreExecutor(configValuesTable, configValueEntity, {
 
 export const configValueExportHook: UserDataExportHook = async (ctx) => {
   if (!featureMounted(ctx, "config")) return null;
-  const rows = await selectMany<Record<string, unknown>>(ctx.db, configValuesTable, {
+  const rows = await ctx.db.selectMany<Record<string, unknown>>(configValuesTable, {
     tenantId: ctx.tenantId,
     userId: ctx.userId,
   });
@@ -39,14 +38,13 @@ export const configValueDeleteHook: UserDataDeleteHook = async (ctx) => {
   // skip: config not mounted — its table doesn't exist, nothing to erase.
   if (!featureMounted(ctx, "config")) return;
   const systemUser = createSystemUser(ctx.tenantId);
-  const tdb = createTenantDb(ctx.db, ctx.tenantId, "system");
-  const rows = await selectMany<Record<string, unknown>>(ctx.db, configValuesTable, {
+  const rows = await ctx.db.selectMany<Record<string, unknown>>(configValuesTable, {
     tenantId: ctx.tenantId,
     userId: ctx.userId,
   });
   for (const row of rows) {
     const id = row["id"]; // @cast-boundary db-row
     if (typeof id !== "string") continue;
-    assertErased(await crud.forget({ id }, systemUser, tdb), "config-value", id);
+    assertErased(await crud.forget({ id }, systemUser, ctx.db), "config-value", id);
   }
 };

package/src/user-data-rights-defaults/hooks/delivery-attempt.userdata-hook.ts

@@ -1,4 +1,3 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
 import { deliveryAttemptsTable } from "../../delivery";
 import { featureMounted } from "./feature-mounted";
@@ -11,7 +10,7 @@ import { featureMounted } from "./feature-mounted";
 
 export const deliveryAttemptExportHook: UserDataExportHook = async (ctx) => {
   if (!featureMounted(ctx, "delivery")) return null;
-  const rows = await selectMany<Record<string, unknown>>(ctx.db, deliveryAttemptsTable, {
+  const rows = await ctx.db.selectMany(deliveryAttemptsTable, {
     tenantId: ctx.tenantId,
     recipientId: ctx.userId,
   });

package/src/user-data-rights-defaults/hooks/file-ref.userdata-hook.ts

@@ -1,9 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import {
-  createEventStoreExecutor,
-  createTenantDb,
-  type TenantDb,
-} from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, type TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { derivativeListPrefix, isDerivativeKeyOf } from "@cosmicdrift/kumiko-framework/derivatives";
 import {
   createSystemUser,
@@ -69,7 +64,7 @@ const crud = createEventStoreExecutor(fileRefsTable, fileRefEntity, { entityName
 export const fileRefExportHook: UserDataExportHook = async (ctx) => {
   // isDeleted:false — soft-deleted (trashed) Files gehören nicht ins
   // Auskunfts-Bundle. Forget (delete-Hook unten) erfasst sie trotzdem.
-  const rawRows = await selectMany(ctx.db, fileRefsTable, {
+  const rawRows = await ctx.db.selectMany(fileRefsTable, {
     tenantId: ctx.tenantId,
     insertedById: ctx.userId,
     isDeleted: false,
@@ -218,8 +213,7 @@ async function severPersonLink(
 
 export const fileRefDeleteHook: UserDataDeleteHook = async (ctx, strategy) => {
   const systemUser = createSystemUser(ctx.tenantId);
-  const tdb = createTenantDb(ctx.db, ctx.tenantId, "system");
-  const rows = await selectMany<Record<string, unknown>>(ctx.db, fileRefsTable, {
+  const rows = await ctx.db.selectMany<Record<string, unknown>>(fileRefsTable, {
     tenantId: ctx.tenantId,
     insertedById: ctx.userId,
   });
@@ -227,7 +221,7 @@ export const fileRefDeleteHook: UserDataDeleteHook = async (ctx, strategy) => {
   if (strategy !== "delete") {
     // anonymize: insertedById=null, FileRef + binary bleiben. Use-case: shared
     // chat-Attachment im Multi-User-Channel — Author-ID raus, Datei bleibt sichtbar.
-    await severPersonLink(tdb, systemUser, rows);
+    await severPersonLink(ctx.db, systemUser, rows);
     // skip: anonymize is complete — the hard-delete path below runs only for strategy "delete".
     return;
   }
@@ -259,6 +253,6 @@ export const fileRefDeleteHook: UserDataDeleteHook = async (ctx, strategy) => {
   for (const row of rows) {
     const id = row["id"]; // @cast-boundary db-row
     if (typeof id !== "string") continue;
-    assertErased(await crud.forget({ id }, systemUser, tdb), "fileRef", id);
+    assertErased(await crud.forget({ id }, systemUser, ctx.db), "fileRef", id);
   }
 };

package/src/user-data-rights-defaults/hooks/in-app-message.userdata-hook.ts

@@ -1,4 +1,3 @@
-import { deleteMany, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
 import { inAppMessagesTable } from "../../channel-in-app";
 import { featureMounted } from "./feature-mounted";
@@ -14,7 +13,7 @@ import { featureMounted } from "./feature-mounted";
 
 export const inAppMessageExportHook: UserDataExportHook = async (ctx) => {
   if (!featureMounted(ctx, "channel-in-app")) return null;
-  const rows = await selectMany<Record<string, unknown>>(ctx.db, inAppMessagesTable, {
+  const rows = await ctx.db.selectMany(inAppMessagesTable, {
     userId: ctx.userId,
     tenantId: ctx.tenantId,
   });
@@ -34,5 +33,5 @@ export const inAppMessageExportHook: UserDataExportHook = async (ctx) => {
 export const inAppMessageDeleteHook: UserDataDeleteHook = async (ctx) => {
   // skip: channel-in-app not mounted — its table doesn't exist, nothing to erase.
   if (!featureMounted(ctx, "channel-in-app")) return;
-  await deleteMany(ctx.db, inAppMessagesTable, { userId: ctx.userId, tenantId: ctx.tenantId });
+  await ctx.db.deleteMany(inAppMessagesTable, { userId: ctx.userId, tenantId: ctx.tenantId });
 };

package/src/user-data-rights-defaults/hooks/job-run.userdata-hook.ts

@@ -1,4 +1,3 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
 import { jobRunsTable } from "../../jobs";
 import { featureMounted } from "./feature-mounted";
@@ -11,7 +10,7 @@ import { featureMounted } from "./feature-mounted";
 
 export const jobRunExportHook: UserDataExportHook = async (ctx) => {
   if (!featureMounted(ctx, "jobs")) return null;
-  const rows = await selectMany<Record<string, unknown>>(ctx.db, jobRunsTable, {
+  const rows = await ctx.db.selectMany<Record<string, unknown>>(jobRunsTable, {
     triggeredById: ctx.userId,
   });
   if (rows.length === 0) return null;