@cosmicdrift/kumiko-bundled-features 0.278.0 → 0.280.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.278.0",
+  "version": "0.280.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -129,12 +129,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.278.0",
-    "@cosmicdrift/kumiko-framework": "0.278.0",
-    "@cosmicdrift/kumiko-headless": "0.278.0",
-    "@cosmicdrift/kumiko-renderer": "0.278.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.278.0",
-    "@cosmicdrift/kumiko-types": "0.278.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.280.0",
+    "@cosmicdrift/kumiko-framework": "0.280.0",
+    "@cosmicdrift/kumiko-headless": "0.280.0",
+    "@cosmicdrift/kumiko-renderer": "0.280.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.280.0",
+    "@cosmicdrift/kumiko-types": "0.280.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -163,7 +163,7 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.278.0",
-    "@cosmicdrift/kumiko-locale-es": "0.278.0"
+    "@cosmicdrift/kumiko-locale-de": "0.280.0",
+    "@cosmicdrift/kumiko-locale-es": "0.280.0"
   }
 }

package/src/auth-email-password/__tests__/invite-flow-kms.integration.test.ts

@@ -14,6 +14,7 @@ import {
   InMemoryKmsAdapter,
   isPiiCiphertext,
 } from "@cosmicdrift/kumiko-framework/crypto";
+import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
@@ -319,7 +320,7 @@ describe("auth flows with active KMS + blind index", () => {
     expect(isPiiCiphertext(rawInvitation["email"])).toBe(true);
 
     const result = await tenantInvitationExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, TENANT_A_ID, "tenant"),
       registry: stack.registry,
       tenantId: TENANT_A_ID,
       userId: bobId,
@@ -347,7 +348,12 @@ describe("auth flows with active KMS + blind index", () => {
     expect(isPiiCiphertext(rawBefore["invited_by"])).toBe(true);
 
     await tenantInvitationDeleteHook(
-      { db: stack.db, registry: stack.registry, tenantId: TENANT_A_ID, userId: aliceId },
+      {
+        db: createTenantDb(stack.db, TENANT_A_ID, "tenant"),
+        registry: stack.registry,
+        tenantId: TENANT_A_ID,
+        userId: aliceId,
+      },
       "delete",
     );
 

package/src/auth-mfa-user-data/__tests__/hooks.integration.test.ts

@@ -3,7 +3,7 @@
 // (not just leave it dangling for a future projection rebuild to resurrect).
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
+import { configureEntityFieldEncryption, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import {
   createTestUser,
   setupTestStack,
@@ -77,7 +77,7 @@ describe("userMfaExportHook / userMfaDeleteHook", () => {
     const user = await enrollUser("export-1");
 
     const snippet = await userMfaExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, user.tenantId, "tenant"),
       registry: stack.registry,
       tenantId: user.tenantId,
       userId: user.id,
@@ -94,7 +94,7 @@ describe("userMfaExportHook / userMfaDeleteHook", () => {
   test("export returns null for a user who never enrolled", async () => {
     const user = createTestUser({ id: "never-enrolled", roles: ["User"] });
     const snippet = await userMfaExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, user.tenantId, "tenant"),
       registry: stack.registry,
       tenantId: user.tenantId,
       userId: user.id,
@@ -106,7 +106,7 @@ describe("userMfaExportHook / userMfaDeleteHook", () => {
     const user = await enrollUser("delete-1");
 
     const before = await userMfaExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, user.tenantId, "tenant"),
       registry: stack.registry,
       tenantId: user.tenantId,
       userId: user.id,
@@ -115,7 +115,7 @@ describe("userMfaExportHook / userMfaDeleteHook", () => {
 
     await userMfaDeleteHook(
       {
-        db: stack.db,
+        db: createTenantDb(stack.db, user.tenantId, "tenant"),
         registry: stack.registry,
         tenantId: user.tenantId,
         userId: user.id,
@@ -124,7 +124,7 @@ describe("userMfaExportHook / userMfaDeleteHook", () => {
     );
 
     const after = await userMfaExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, user.tenantId, "tenant"),
       registry: stack.registry,
       tenantId: user.tenantId,
       userId: user.id,

package/src/auth-mfa-user-data/hooks.ts

@@ -7,8 +7,7 @@
 // replays via the event, a raw DELETE would be resurrected by a
 // projection rebuild).
 
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
   type UserDataDeleteHook,
@@ -26,7 +25,7 @@ const executor = createEventStoreExecutor(userMfaTable, userMfaEntity, {
 // tokenHash exclusion in user-data-rights-defaults). Just confirms
 // enrollment + when, which is what a data subject actually needs to see.
 export const userMfaExportHook: UserDataExportHook = async (ctx) => {
-  const rows = await selectMany<{ id: string; enabledAt: unknown }>(ctx.db, userMfaTable, {
+  const rows = await ctx.db.selectMany<{ id: string; enabledAt: unknown }>(userMfaTable, {
     userId: ctx.userId,
     tenantId: ctx.tenantId,
   });
@@ -41,15 +40,14 @@ export const userMfaExportHook: UserDataExportHook = async (ctx) => {
 // secret can't be anonymized, and `personal: { of: "userId" }` already
 // means this row belongs to exactly one user (never shared tenant data).
 export const userMfaDeleteHook: UserDataDeleteHook = async (ctx) => {
-  const rows = await selectMany<{ id: string }>(ctx.db, userMfaTable, {
+  const rows = await ctx.db.selectMany<{ id: string }>(userMfaTable, {
     userId: ctx.userId,
     tenantId: ctx.tenantId,
   });
   // skip: nothing enrolled for this user — no row to erase
   if (rows.length === 0) return;
   const systemUser = createSystemUser(ctx.tenantId);
-  const tdb = createTenantDb(ctx.db, ctx.tenantId, "system");
   for (const row of rows) {
-    assertErased(await executor.forget({ id: row.id }, systemUser, tdb), "user-mfa", row.id);
+    assertErased(await executor.forget({ id: row.id }, systemUser, ctx.db), "user-mfa", row.id);
   }
 };

package/src/custom-fields/__tests__/user-data-rights.integration.test.ts

@@ -71,8 +71,14 @@ const propertyTable = buildEntityTable("property", propertyEntity);
 // Host entity gets its own EXT_USER_DATA-registration too — that's the
 // canonical setup. The host's anonymize hook NULLS inserted_by_id; the
 // custom-fields wiring contributes export only (#972).
+// fw#2914 — "property" is a managed r.entity table (EXECUTOR_ONLY-branded), so
+// TenantDb's typed write methods reject it; these host hooks need raw SQL,
+// still filtered by inserted_by_id + tenant_id.
+const HOST_HOOK_REASON =
+  "fw#2914 test fixture: host export/delete against a managed entity table needs raw SQL (TenantDb's typed write API rejects EXECUTOR_ONLY tables); filtered by inserted_by_id + tenant_id";
+
 const hostExportHook: UserDataExportHook = async (ctx) => {
-  const rows = await asRawClient(ctx.db).unsafe(
+  const rows = await asRawClient(ctx.db.unsafeRaw(HOST_HOOK_REASON)).unsafe(
     `SELECT id, name FROM read_t15c_properties WHERE inserted_by_id = $1 AND tenant_id = $2`,
     [ctx.userId, ctx.tenantId],
   );
@@ -86,13 +92,13 @@ const hostExportHook: UserDataExportHook = async (ctx) => {
 
 const hostDeleteHook: UserDataDeleteHook = async (ctx, strategy) => {
   if (strategy === "delete") {
-    await asRawClient(ctx.db).unsafe(
+    await asRawClient(ctx.db.unsafeRaw(HOST_HOOK_REASON)).unsafe(
       `DELETE FROM read_t15c_properties WHERE inserted_by_id = $1 AND tenant_id = $2`,
       [ctx.userId, ctx.tenantId],
     );
   } else {
     // anonymize: clear owner, keep row + customFields.
-    await asRawClient(ctx.db).unsafe(
+    await asRawClient(ctx.db.unsafeRaw(HOST_HOOK_REASON)).unsafe(
       `UPDATE read_t15c_properties SET inserted_by_id = NULL WHERE inserted_by_id = $1 AND tenant_id = $2`,
       [ctx.userId, ctx.tenantId],
     );
@@ -111,6 +117,7 @@ const propertyFeature = defineFeature("property-t15c", (r) => {
   r.useExtension(EXT_USER_DATA, "property", {
     export: hostExportHook,
     delete: hostDeleteHook,
+    escapeHatch: { reason: HOST_HOOK_REASON },
   });
 
   const { executor } = createEntityExecutor("property", propertyEntity);

package/src/custom-fields/wire-user-data-rights.ts

@@ -1,7 +1,7 @@
 // T1.5c — user-data-rights wiring for custom-fields.
 
-import { extractTableName } from "@cosmicdrift/kumiko-framework/db";
-import type { UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
+import { type DbRunner, extractTableName } from "@cosmicdrift/kumiko-framework/db";
+import type { UserDataExportSnippet, UserDataHookCtx } from "@cosmicdrift/kumiko-framework/engine";
 import { EXT_USER_DATA, type FeatureRegistrar } from "@cosmicdrift/kumiko-framework/engine";
 import { selectCustomFieldsHostRows } from "./db/queries/user-data-rights";
 
@@ -27,6 +27,41 @@ function asCustomFieldsHostRow(value: unknown): CustomFieldsHostRow | null {
   return { id: value.id, customFields: Object.fromEntries(Object.entries(cf)) };
 }
 
+// fw#2914 — selectCustomFieldsHostRows runs raw SQL against a dynamic host
+// table name (opts.entityTable varies per call site), so it can't go through
+// TenantDb's typed method API (table param must be a known SchemaTable). The
+// SQL text itself still filters `tenant_id = ctx.tenantId`, so this stays a
+// single-tenant read — the escapeHatch is only for the raw-SQL mechanism, not
+// for cross-tenant access.
+const CUSTOM_FIELDS_EXPORT_REASON =
+  "custom-fields export reads a generic customFields column via raw SQL against a dynamic host table name, not expressible through TenantDb's typed method API; the query still filters tenant_id = ctx.tenantId";
+
+async function exportCustomFields(
+  db: DbRunner,
+  ctx: UserDataHookCtx,
+  tableName: string,
+  opts: WireCustomFieldsUserDataRightsOptions,
+): Promise<UserDataExportSnippet | null> {
+  const rows = await selectCustomFieldsHostRows(
+    db,
+    tableName,
+    opts.userIdColumn,
+    ctx.userId,
+    ctx.tenantId,
+  );
+  const snippetRows: Array<{ id: string; customFields: Record<string, unknown> }> = [];
+  for (const raw of rows) {
+    const row = asCustomFieldsHostRow(raw);
+    if (!row) continue;
+    const customFields = row.customFields;
+    if (customFields && Object.keys(customFields).length > 0) {
+      snippetRows.push({ id: row.id, customFields });
+    }
+  }
+  if (snippetRows.length === 0) return null;
+  return { entity: `${opts.entityName}.customFields`, rows: snippetRows };
+}
+
 // Export-only wiring: custom fields hold supplemental business data, not PII
 // (#972) — there is nothing to redact on user-forget, only Art. 20 export.
 export function wireCustomFieldsUserDataRightsFor<TReg extends FeatureRegistrar<string>>(
@@ -35,29 +70,10 @@ export function wireCustomFieldsUserDataRightsFor<TReg extends FeatureRegistrar<
 ): void {
   const tableName = extractTableName(opts.entityTable, "custom-fields/wire-user-data-rights");
 
-  const exportHook: UserDataExportHook = async (ctx) => {
-    const rows = await selectCustomFieldsHostRows(
-      ctx.db,
-      tableName,
-      opts.userIdColumn,
-      ctx.userId,
-      ctx.tenantId,
-    );
-    const snippetRows: Array<{ id: string; customFields: Record<string, unknown> }> = [];
-    for (const raw of rows) {
-      const row = asCustomFieldsHostRow(raw);
-      if (!row) continue;
-      const customFields = row.customFields;
-      if (customFields && Object.keys(customFields).length > 0) {
-        snippetRows.push({ id: row.id, customFields });
-      }
-    }
-    if (snippetRows.length === 0) return null;
-    return { entity: `${opts.entityName}.customFields`, rows: snippetRows };
-  };
-
   // biome-ignore lint/correctness/useHookAtTopLevel: r.useExtension is a registrar API, not a React hook.
   r.useExtension(EXT_USER_DATA, opts.entityName, {
-    export: exportHook,
+    export: async (ctx: UserDataHookCtx) =>
+      exportCustomFields(ctx.db.unsafeRaw(CUSTOM_FIELDS_EXPORT_REASON), ctx, tableName, opts),
+    escapeHatch: { reason: CUSTOM_FIELDS_EXPORT_REASON },
   });
 }

package/src/data-retention/resolve-for-tenant.ts

@@ -7,15 +7,22 @@
 // + `resolveRetentionPolicy`, also kein Drift-Risiko.
 
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRetentionOverrideOrNull } from "./_internal/parse-override";
 import type { RetentionPresetKey } from "./presets";
 import { type EffectiveRetentionPolicy, resolveRetentionPolicy } from "./resolver";
 import { tenantRetentionOverrideTable } from "./schema/tenant-retention-override";
 
+function isTenantDb(db: DbRunner | TenantDb): db is TenantDb {
+  return typeof (db as Partial<TenantDb>).unsafeRaw === "function";
+}
+
 export interface ResolveForTenantArgs {
-  readonly db: DbRunner;
+  // fw#2914 — a EXT_USER_DATA hook's ctx.db is a TenantDb (method-form);
+  // the cleanup cron's own db is still a raw DbRunner. Both are valid here —
+  // this lookup is a plain tenant-scoped read either way.
+  readonly db: DbRunner | TenantDb;
   readonly registry: Registry;
   readonly tenantId: TenantId;
   readonly entityName: string;
@@ -43,10 +50,15 @@ export async function resolveRetentionPolicyForTenant(
   const overrideRow =
     args.preloadedOverride !== undefined
       ? args.preloadedOverride
-      : ((await fetchOne(args.db, tenantRetentionOverrideTable, {
-          tenantId: args.tenantId,
-          entityName: args.entityName,
-        })) as { config: string | null } | null); // @cast-boundary db-runner
+      : isTenantDb(args.db)
+        ? ((await args.db.fetchOne<{ config: string | null }>(tenantRetentionOverrideTable, {
+            tenantId: args.tenantId,
+            entityName: args.entityName,
+          })) ?? null)
+        : ((await fetchOne(args.db, tenantRetentionOverrideTable, {
+            tenantId: args.tenantId,
+            entityName: args.entityName,
+          })) as { config: string | null } | null); // @cast-boundary db-runner
 
   const tenantOverride = parseRetentionOverrideOrNull(
     overrideRow?.config ?? null,

package/src/delivery/db/queries/preferences.ts

@@ -8,6 +8,7 @@ export type NotificationPreferenceRow = {
   readonly enabled: boolean;
 };
 
+// @wrapper-known semantic-alias
 export async function selectNotificationPreferences(
   db: DbConnection,
   tenantId: TenantId,

package/src/files-tenant-data/hooks.ts

@@ -18,8 +18,7 @@
 //     cross into another tenant's keys (the provider's own list() prefix
 //     already scopes it).
 
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
   type StorageProviderDestroyTenantHook,
@@ -34,13 +33,12 @@ import {
 const crud = createEventStoreExecutor(fileRefsTable, fileRefEntity, { entityName: "fileRef" });
 
 export const fileRefTenantDestroyHook: TenantDataDestroyHook = async (ctx) => {
-  const rows = await selectMany<{ id: string }>(ctx.db, fileRefsTable, {
+  const rows = await ctx.db.selectMany<{ id: string }>(fileRefsTable, {
     tenantId: ctx.tenantId,
   });
   const user = createSystemUser(ctx.tenantId);
-  const db = createTenantDb(ctx.db, ctx.tenantId, "system");
   for (const row of rows) {
-    const result = await crud.forget({ id: row.id }, user, db);
+    const result = await crud.forget({ id: row.id }, user, ctx.db);
     // Executor writes return {isSuccess:false} instead of throwing — a
     // discarded result would report this destroy stage "succeeded" while the
     // row (and its PII fileName) survives. Throw so the pipeline's

package/src/folders/__tests__/folders.integration.test.ts

@@ -17,6 +17,7 @@
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { createEntity, createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -402,7 +403,7 @@ describe("folders-user-data — tenantScopedDelete hooks", () => {
   test("multi-user tenant: no-op, rows survive", async () => {
     await seedOneFolderWithAssignment();
     const ctx = {
-      db: stack.db,
+      db: createTenantDb(stack.db, admin.tenantId, "tenant"),
       registry: stack.registry,
       tenantId: admin.tenantId,
       userId: admin.id,
@@ -417,7 +418,7 @@ describe("folders-user-data — tenantScopedDelete hooks", () => {
   test("anonymize strategy: no-op even on a single-user tenant", async () => {
     await seedOneFolderWithAssignment();
     const ctx = {
-      db: stack.db,
+      db: createTenantDb(stack.db, admin.tenantId, "tenant"),
       registry: stack.registry,
       tenantId: admin.tenantId,
       userId: admin.id,
@@ -432,7 +433,7 @@ describe("folders-user-data — tenantScopedDelete hooks", () => {
   test("single-user tenant + delete: rows are purged", async () => {
     await seedOneFolderWithAssignment();
     const ctx = {
-      db: stack.db,
+      db: createTenantDb(stack.db, admin.tenantId, "tenant"),
       registry: stack.registry,
       tenantId: admin.tenantId,
       userId: admin.id,

package/src/folders-user-data/__tests__/hooks.integration.test.ts

@@ -11,6 +11,7 @@
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { createEntity, createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -87,7 +88,7 @@ describe("folderAssignmentExportHook", () => {
     );
 
     const snippet = await folderAssignmentExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, admin.tenantId, "tenant"),
       registry: stack.registry,
       tenantId: admin.tenantId,
       userId: admin.id,

package/src/folders-user-data/hooks.ts

@@ -4,8 +4,7 @@
 // Mirrors credit-user-data — standard tenant-scoped pattern, no name-stripping
 // (a folder name is tenant data, not per-user PII).
 
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createTenantDb, type EventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import type { EventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import {
   createEntityExecutor,
   createSystemUser,
@@ -27,9 +26,7 @@ const { table: folderAssignmentTable, executor: folderAssignmentExecutor } = cre
 // all tenant folders in-app, so bundling them into the user's export is no new
 // exposure — it gives the data subject the organisation of the loans they work with.
 export const folderExportHook: UserDataExportHook = async (ctx) => {
-  const rows = await selectMany<Record<string, unknown>>(ctx.db, folderTable, {
-    tenantId: ctx.tenantId,
-  });
+  const rows = await ctx.db.selectMany(folderTable, { tenantId: ctx.tenantId });
   if (rows.length === 0) return null;
   return { entity: "folder", rows };
 };
@@ -38,7 +35,7 @@ export const folderAssignmentExportHook: UserDataExportHook = async (ctx) => {
   // folderAssignmentEntity is softDelete: true — a cleared assignment
   // (isDeleted: true) is a removed folder membership, not something the GDPR
   // export should still surface as current data.
-  const rows = await selectMany<Record<string, unknown>>(ctx.db, folderAssignmentTable, {
+  const rows = await ctx.db.selectMany(folderAssignmentTable, {
     tenantId: ctx.tenantId,
     isDeleted: false,
   });
@@ -65,11 +62,9 @@ function tenantScopedDelete(
     // eventless, so a projection rebuild resurrects the rows. Bounded — forget
     // only fires for single-user tenants.
     const systemUser = createSystemUser(ctx.tenantId);
-    // The executor needs a TenantDb (loadById → db.fetchOne), not the raw ctx.db.
-    const tdb = createTenantDb(ctx.db, ctx.tenantId, "system");
-    const rows = await selectMany<{ id: string }>(ctx.db, table, { tenantId: ctx.tenantId });
+    const rows = await ctx.db.selectMany<{ id: string }>(table, { tenantId: ctx.tenantId });
     for (const row of rows) {
-      await executor.delete({ id: row.id }, systemUser, tdb);
+      await executor.delete({ id: row.id }, systemUser, ctx.db);
     }
   };
 }

package/src/form-draft-user-data/__tests__/hooks-delete-failure.integration.test.ts

@@ -7,6 +7,7 @@
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -50,7 +51,12 @@ describe("formDraftDeleteHook — delete failure handling (#review-batch-fw-1)",
 
     await expect(
       formDraftDeleteHook(
-        { db: stack.db, registry: stack.registry, tenantId: bob.tenantId, userId: bob.id },
+        {
+          db: createTenantDb(stack.db, bob.tenantId, "tenant"),
+          registry: stack.registry,
+          tenantId: bob.tenantId,
+          userId: bob.id,
+        },
         "delete",
       ),
     ).resolves.toBeUndefined();

package/src/form-draft-user-data/__tests__/hooks.integration.test.ts

@@ -5,6 +5,7 @@
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -52,7 +53,7 @@ describe("formDraftExportHook", () => {
     );
 
     const snippet = await formDraftExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, owner.tenantId, "tenant"),
       registry: stack.registry,
       tenantId: owner.tenantId,
       userId: owner.id,
@@ -88,7 +89,7 @@ describe("formDraftExportHook", () => {
     );
 
     const snippet = await formDraftExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, tenantATestTenantId, "tenant"),
       registry: stack.registry,
       tenantId: tenantATestTenantId,
       userId: sameIdTenantA.id,
@@ -101,7 +102,7 @@ describe("formDraftExportHook", () => {
   test("returns null when the user saved no drafts", async () => {
     const lurker = createTestUser({ id: 3, roles: ["TenantMember"] });
     const snippet = await formDraftExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, lurker.tenantId, "tenant"),
       registry: stack.registry,
       tenantId: lurker.tenantId,
       userId: lurker.id,
@@ -126,7 +127,12 @@ describe("formDraftDeleteHook", () => {
     );
 
     await formDraftDeleteHook(
-      { db: stack.db, registry: stack.registry, tenantId: alice.tenantId, userId: alice.id },
+      {
+        db: createTenantDb(stack.db, alice.tenantId, "tenant"),
+        registry: stack.registry,
+        tenantId: alice.tenantId,
+        userId: alice.id,
+      },
       "delete",
     );
 
@@ -138,7 +144,12 @@ describe("formDraftDeleteHook", () => {
     const lurker = createTestUser({ id: 13, roles: ["TenantMember"] });
     await expect(
       formDraftDeleteHook(
-        { db: stack.db, registry: stack.registry, tenantId: lurker.tenantId, userId: lurker.id },
+        {
+          db: createTenantDb(stack.db, lurker.tenantId, "tenant"),
+          registry: stack.registry,
+          tenantId: lurker.tenantId,
+          userId: lurker.id,
+        },
         "delete",
       ),
     ).resolves.toBeUndefined();

package/src/form-draft-user-data/hooks.ts

@@ -3,8 +3,6 @@
 // consumers without the user-data-rights pipeline don't pull a hard
 // dependency.
 
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
   type UserDataDeleteHook,
@@ -13,7 +11,7 @@ import {
 import { formDraftExecutor, formDraftTable } from "../form-draft";
 
 export const formDraftExportHook: UserDataExportHook = async (ctx) => {
-  const rows = await selectMany<Record<string, unknown>>(ctx.db, formDraftTable, {
+  const rows = await ctx.db.selectMany(formDraftTable, {
     tenantId: ctx.tenantId,
     ownerId: ctx.userId,
   });
@@ -37,15 +35,14 @@ export const formDraftExportHook: UserDataExportHook = async (ctx) => {
 // owners' drafts, tenant model doesn't matter here (unlike folders' single-
 // user gating: a form-draft row always has exactly one owner already).
 export const formDraftDeleteHook: UserDataDeleteHook = async (ctx) => {
-  const rows = await selectMany<{ id: string }>(ctx.db, formDraftTable, {
+  const rows = await ctx.db.selectMany<{ id: string }>(formDraftTable, {
     tenantId: ctx.tenantId,
     ownerId: ctx.userId,
   });
   const systemUser = createSystemUser(ctx.tenantId);
-  const tdb = createTenantDb(ctx.db, ctx.tenantId, "system");
   const failures: string[] = [];
   for (const row of rows) {
-    const result = await formDraftExecutor.delete({ id: row.id }, systemUser, tdb);
+    const result = await formDraftExecutor.delete({ id: row.id }, systemUser, ctx.db);
     if (!result.isSuccess) {
       failures.push(`${row.id}: ${result.error.message}`);
     }

package/src/notes-history-user-data/__tests__/hooks.integration.test.ts

@@ -5,6 +5,7 @@
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { createEntity, createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -78,7 +79,7 @@ describe("noteEntryExportHook", () => {
     );
 
     const snippet = await noteEntryExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, author.tenantId, "tenant"),
       registry: stack.registry,
       tenantId: author.tenantId,
       userId: author.id,
@@ -95,7 +96,7 @@ describe("noteEntryExportHook", () => {
   test("returns null when the user authored no notes", async () => {
     const lurker = createTestUser({ id: 3, roles: ["TenantMember"] });
     const snippet = await noteEntryExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, lurker.tenantId, "tenant"),
       registry: stack.registry,
       tenantId: lurker.tenantId,
       userId: lurker.id,
@@ -107,7 +108,12 @@ describe("noteEntryExportHook", () => {
 describe("noteEntryDeleteHook", () => {
   test("is a no-op — resolves without throwing", async () => {
     const result = await noteEntryDeleteHook(
-      { db: stack.db, registry: stack.registry, tenantId: author.tenantId, userId: author.id },
+      {
+        db: createTenantDb(stack.db, author.tenantId, "tenant"),
+        registry: stack.registry,
+        tenantId: author.tenantId,
+        userId: author.id,
+      },
       "delete",
     );
     expect(result).toBeUndefined();

package/src/notes-history-user-data/hooks.ts

@@ -4,7 +4,6 @@
 // dependency. Mirrors job-run/delivery-attempt (user-data-rights-defaults):
 // export-only, erasure via crypto-shredding.
 
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms } from "@cosmicdrift/kumiko-framework/crypto";
 import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
 import { resolveRetentionPolicyForTenant } from "../data-retention";
@@ -14,7 +13,7 @@ import { policyToStrategy } from "../user-data-rights";
 // note-entry has no per-tenant scope quirk (unlike folders) — it's genuinely
 // per-user content, so the export filters by authorId directly.
 export const noteEntryExportHook: UserDataExportHook = async (ctx) => {
-  const rows = await selectMany<Record<string, unknown>>(ctx.db, noteEntryTable, {
+  const rows = await ctx.db.selectMany(noteEntryTable, {
     authorId: ctx.userId,
   });
   if (rows.length === 0) return null;
@@ -55,7 +54,7 @@ export const noteEntryDeleteHook: UserDataDeleteHook = async (ctx) => {
   // skip: no KMS adapter mounted — record-owned fields stay plaintext framework-wide, forget is a true no-op
   if (!kms) return;
 
-  const mentions = await selectMany<{ noteId: string }>(ctx.db, noteMentionTable, {
+  const mentions = await ctx.db.selectMany<{ noteId: string }>(noteMentionTable, {
     subjectId: ctx.userId,
   });
   // skip: no note-mention rows for this user — nothing structurally reaches this user's data to shred
@@ -63,7 +62,7 @@ export const noteEntryDeleteHook: UserDataDeleteHook = async (ctx) => {
 
   const noteIds = new Set(mentions.map((m) => m.noteId));
   for (const noteId of noteIds) {
-    const note = await fetchOne<{ entityType: string }>(ctx.db, noteEntryTable, { id: noteId });
+    const note = await ctx.db.fetchOne<{ entityType: string }>(noteEntryTable, { id: noteId });
     // Defensive: append-only rows are never hard-deleted, so this shouldn't
     // happen — but a missing host means no retention policy to consult.
     if (!note) continue;