@cosmicdrift/kumiko-bundled-features 0.278.0 → 0.280.0

package/src/user-data-rights/__tests__/run-forget-cleanup.integration.test.ts

@@ -20,7 +20,11 @@ import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import { InMemoryKmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
 import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
-import type { JobContext } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createSystemUser,
+  type JobContext,
+  SYSTEM_TENANT_ID,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import {
   setupTestStack,
@@ -50,7 +54,7 @@ let stack: TestStack;
 
 const TENANT_A = "00000000-0000-4000-8000-00000000000a";
 const TENANT_B = "00000000-0000-4000-8000-00000000000b";
-const TENANT_SYSTEM = "00000000-0000-4000-8000-000000000001";
+const TENANT_SYSTEM = SYSTEM_TENANT_ID;
 
 // Deterministische UUIDs fuer Tests — gleiche Helper wie in
 // user-data-rights-defaults.
@@ -318,6 +322,7 @@ describe("run-forget-cleanup :: registered cron (autonomous Art.17)", () => {
       }),
       registry: stack.registry,
       log,
+      systemUser: createSystemUser(TENANT_A),
     };
     await job?.handler({}, jobCtx as unknown as JobContext);
 
@@ -359,6 +364,7 @@ describe("run-forget-cleanup :: registered cron (autonomous Art.17)", () => {
           unsafeRaw: { reason: "executes overdue Art.17 forget requests across every tenant" },
         }),
         registry: stack.registry,
+        systemUser: createSystemUser(TENANT_A),
         log,
       } as unknown as JobContext);
     } finally {

package/src/user-data-rights/__tests__/run-user-export.integration.test.ts

@@ -25,7 +25,11 @@ import {
   isPiiCiphertext,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
-import { createSystemUser, type UserDataHookCtx } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createSystemUser,
+  SYSTEM_TENANT_ID,
+  type UserDataHookCtx,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { fileRefEntity, fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import {
   setupTestStack,
@@ -58,7 +62,7 @@ let stack: TestStack;
 
 const TENANT_A = "00000000-0000-4000-8000-00000000000a";
 const TENANT_B = "00000000-0000-4000-8000-00000000000b";
-const TENANT_SYSTEM = "00000000-0000-4000-8000-000000000001";
+const TENANT_SYSTEM = SYSTEM_TENANT_ID;
 
 function uuid(suffix: number): string {
   return `bbbbbbbb-bbbb-4bbb-8bbb-${suffix.toString(16).padStart(12, "0")}`;
@@ -498,7 +502,7 @@ describe("runUserExport :: tenant-invitation PII export (#1937)", () => {
     // in the GDPR bundle. The hook decrypts locally (same as invitations
     // query) — assert plaintext here so a regression to raw ciphertext fails.
     const hookCtx: UserDataHookCtx = {
-      db: stack.db,
+      db: createTenantDb(stack.db, TENANT_A, "tenant"),
       registry: stack.registry,
       tenantId: TENANT_A,
       userId: ALICE_ID,
@@ -571,7 +575,7 @@ describe("runUserExport :: fileRef PII export via the fileRefs side-channel (#19
     // assertion would catch it even though the runUserExport() assertions
     // below would stay green either way.
     const hookCtx: UserDataHookCtx = {
-      db: stack.db,
+      db: createTenantDb(stack.db, TENANT_A, "tenant"),
       registry: stack.registry,
       tenantId: TENANT_A,
       userId: ALICE_ID,

package/src/user-data-rights/__tests__/tenant-model-erasure.integration.test.ts

@@ -65,11 +65,6 @@ const TABLE = "read_dsgvo_tenant_scoped";
 
 // Tenant-scoped contributor with NO per-user column — deletes by tenant only,
 // and ONLY when this tenant is effectively single-user (mirrors credit).
-const tenantScopedDeleteHook: UserDataDeleteHook = async (ctx) => {
-  if (ctx.tenantModel !== "single-user") return; // shared tenant: erasing would hit co-members
-  await asRawClient(ctx.db).unsafe(`DELETE FROM ${TABLE} WHERE tenant_id = $1`, [ctx.tenantId]);
-};
-
 const scopedEntity = createEntity({
   table: TABLE,
   fields: {
@@ -77,11 +72,26 @@ const scopedEntity = createEntity({
   },
 });
 
+// fw#2914 — "tenant-scoped" is a managed r.entity table (EXECUTOR_ONLY-branded),
+// so TenantDb's typed write methods reject it; this delete is raw SQL, still
+// filtered by tenant_id.
+const TENANT_SCOPED_DELETE_REASON =
+  "fw#2914 test fixture: tenant-scoped erasure against a managed entity table needs raw SQL (TenantDb's typed write API rejects EXECUTOR_ONLY tables); filtered by tenant_id";
+
+const tenantScopedDeleteHook: UserDataDeleteHook = async (ctx) => {
+  if (ctx.tenantModel !== "single-user") return; // shared tenant: erasing would hit co-members
+  await asRawClient(ctx.db.unsafeRaw(TENANT_SCOPED_DELETE_REASON)).unsafe(
+    `DELETE FROM ${TABLE} WHERE tenant_id = $1`,
+    [ctx.tenantId],
+  );
+};
+
 const contributorFeature = defineFeature("dsgvo-tenant-scoped", (r) => {
   r.entity("tenant-scoped", scopedEntity);
   r.useExtension(EXT_USER_DATA, "tenant-scoped", {
     export: async () => null,
     delete: tenantScopedDeleteHook,
+    escapeHatch: { reason: TENANT_SCOPED_DELETE_REASON },
   });
 });
 

package/src/user-data-rights/feature.ts

@@ -610,6 +610,8 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
           ...(opts.appExportDownloadUrl !== undefined && {
             appExportDownloadUrl: opts.appExportDownloadUrl,
           }),
+          escapeHatchAuditSink: ctx._escapeHatchAuditSink,
+          actor: ctx.systemUser.id,
         });
       },
     });
@@ -677,6 +679,8 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
             handlerName: "user-data-rights:run-forget-cleanup",
           }),
           ...(sendDeletionExecutedEmail && { sendDeletionExecutedEmail }),
+          escapeHatchAuditSink: ctx._escapeHatchAuditSink,
+          actor: ctx.systemUser.id,
         });
 
         // Persist each incomplete report on the job-run log (#1572). The write

package/src/user-data-rights/run-export-jobs.ts

@@ -49,7 +49,11 @@ import { addDurationSpec } from "@cosmicdrift/kumiko-framework/compliance";
 import { PII_ERASED_SENTINEL } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection, DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
-import type { Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type {
+  EscapeHatchAuditSink,
+  Registry,
+  TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { createSystemUser } from "@cosmicdrift/kumiko-framework/engine";
 import {
   createZipStream,
@@ -155,6 +159,11 @@ export interface RunExportJobsArgs {
    *  a URL fragment (not a query param — see issue #1271) and passes that
    *  Callback durch. Required wenn sendExportReadyEmail gesetzt. */
   readonly appExportDownloadUrl?: string;
+
+  // fw#2914 — sourced from the owning job's ctx (_escapeHatchAuditSink,
+  // systemUser.id); threaded into runUserExport's per-hook TenantDb.
+  readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
+  readonly actor?: string;
 }
 
 export interface ExportJobError {
@@ -219,6 +228,8 @@ export async function runExportJobs(args: RunExportJobsArgs): Promise<RunExportJ
       buildStorageProvider,
       now,
       job,
+      escapeHatchAuditSink: args.escapeHatchAuditSink,
+      actor: args.actor,
     });
     if (outcome.kind === "done") {
       completedJobIds.push(job.id);
@@ -337,6 +348,8 @@ async function processJob(args: {
   buildStorageProvider: (tenantId: TenantId) => Promise<FileStorageProvider>;
   now: Instant;
   job: JobRow;
+  escapeHatchAuditSink?: EscapeHatchAuditSink;
+  actor?: string;
 }): Promise<ProcessOutcome> {
   const { db, registry, buildStorageProvider, now, job } = args;
   const executor = createSystemUser(job.requestedFromTenantId);
@@ -381,6 +394,8 @@ async function processJob(args: {
       registry,
       userId: job.userId,
       now,
+      escapeHatchAuditSink: args.escapeHatchAuditSink,
+      actor: args.actor,
     });
 
     const profile = await resolveProfileForTenant({

package/src/user-data-rights/run-forget-cleanup.ts

@@ -39,14 +39,17 @@ import {
   subjectIdToKey,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import {
+  createTenantDb,
   type DbRunner,
   entityEventName,
   executeRawQuery,
   nullBlindIndexesForSubject,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
+  type EscapeHatchAuditSink,
   EXT_USER_DATA,
   EXT_USER_DATA_ORDER,
+  extensionUsageEscapeHatchReason,
   type Registry,
   type TenantId,
   type TenantUserModel,
@@ -54,6 +57,7 @@ import {
   type UserDataDeleteStrategy,
   type UserDataStorageProvider,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { createEscapeHatchReporter } from "@cosmicdrift/kumiko-framework/pipeline";
 import {
   purgeSearchDocumentsForSubject,
   type SearchAdapter,
@@ -140,6 +144,12 @@ export interface RunForgetCleanupArgs {
    * (no tenant-scoped erasure).
    */
   readonly tenantModel?: TenantUserModel;
+
+  // fw#2914 — sourced from the owning job's ctx (_escapeHatchAuditSink,
+  // systemUser.id); attributes+audits any EXT_USER_DATA usage's declared
+  // escapeHatch when its delete hook calls ctx.db.unsafeRaw(reason).
+  readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
+  readonly actor?: string;
 }
 
 export interface ForgetCleanupError {
@@ -184,6 +194,26 @@ interface HookEntry {
   /** Lower runs first. Owner-column-preserving redaction declares a negative
    * order so it precedes owner-nulling hooks on the same entity (see sort below). */
   readonly order: number;
+  readonly escapeHatchReason: string | undefined;
+}
+
+function buildHookDb(
+  db: DbRunner,
+  tenantId: TenantId,
+  entry: HookEntry,
+  args: { readonly escapeHatchAuditSink?: EscapeHatchAuditSink; readonly actor?: string },
+) {
+  const report = createEscapeHatchReporter({
+    handler: `${EXT_USER_DATA}:${entry.entityName}`,
+    tenantId,
+    actor: args.actor ?? "system",
+    sink: args.escapeHatchAuditSink,
+  });
+  return createTenantDb(db, tenantId, "tenant", undefined, undefined, undefined, {
+    unsafeRaw:
+      entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
+    report,
+  });
 }
 
 // EXT_USER_DATA delete-hooks default here; a hook that redacts data keyed on an
@@ -226,7 +256,12 @@ export async function runForgetCleanup(
       const opts = (u.options ?? {}) as { delete?: UserDataDeleteHook; order?: number }; // @cast-boundary engine-payload
       if (!opts.delete) return null;
       const order = typeof opts.order === "number" ? opts.order : HOOK_ORDER_DEFAULT;
-      return { entityName: u.entityName, deleteHook: opts.delete, order };
+      return {
+        entityName: u.entityName,
+        deleteHook: opts.delete,
+        order,
+        escapeHatchReason: extensionUsageEscapeHatchReason(u),
+      };
     })
     .filter((x): x is HookEntry => x !== null)
     // Order ascending. Array.sort is ES2019-stable, so equal orders keep
@@ -252,6 +287,8 @@ export async function runForgetCleanup(
       appTenantModel,
       kms,
       searchAdapter: args.searchAdapter,
+      escapeHatchAuditSink: args.escapeHatchAuditSink,
+      actor: args.actor,
     });
     hookCallsAttempted += userResult.hookCallsAttempted;
     errors.push(...userResult.errors);
@@ -316,6 +353,8 @@ async function processUser(args: {
   appTenantModel: TenantUserModel;
   kms?: KmsAdapter;
   searchAdapter?: SearchAdapter;
+  escapeHatchAuditSink?: EscapeHatchAuditSink;
+  actor?: string;
 }): Promise<ProcessUserResult> {
   const { db, registry, userId, hookEntries, buildStorageProvider, appTenantModel, kms } = args;
   const errors: ForgetCleanupError[] = [];
@@ -404,7 +443,10 @@ async function processUser(args: {
           hookCallsAttempted++;
           const hookResult = await entry.deleteHook(
             {
-              db: tx,
+              db: buildHookDb(tx, tenantId, entry, {
+                escapeHatchAuditSink: args.escapeHatchAuditSink,
+                actor: args.actor,
+              }),
               registry,
               tenantId,
               userId,

package/src/user-data-rights/run-user-export.ts

@@ -30,15 +30,19 @@ import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import {
   collectEncryptedFieldNames,
   configuredEntityFieldEncryption,
+  createTenantDb,
   decryptEntityFieldValues,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
+  type EscapeHatchAuditSink,
   EXT_USER_DATA,
+  extensionUsageEscapeHatchReason,
   type Registry,
   type TenantId,
   type UserDataExportHook,
   type UserDataExportSnippet,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { createEscapeHatchReporter } from "@cosmicdrift/kumiko-framework/pipeline";
 import type { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { tenantMembershipsTable } from "../tenant";
 import { buildFileRefZipPath } from "./zip-path";
@@ -50,6 +54,11 @@ export interface RunUserExportArgs {
   readonly registry: Registry;
   readonly userId: string;
   readonly now: Instant;
+  // fw#2914 — sourced from the owning job's ctx (_escapeHatchAuditSink,
+  // systemUser.id); attributes+audits any EXT_USER_DATA usage's declared
+  // escapeHatch when its export hook calls ctx.db.unsafeRaw(reason).
+  readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
+  readonly actor?: string;
 }
 
 export interface UserExportFileRef {
@@ -90,6 +99,26 @@ export interface UserExportBundle {
 interface HookEntry {
   readonly entityName: string;
   readonly exportHook: UserDataExportHook;
+  readonly escapeHatchReason: string | undefined;
+}
+
+function buildHookDb(
+  db: DbRunner,
+  tenantId: TenantId,
+  entry: HookEntry,
+  args: Pick<RunUserExportArgs, "escapeHatchAuditSink" | "actor">,
+) {
+  const report = createEscapeHatchReporter({
+    handler: `${EXT_USER_DATA}:${entry.entityName}`,
+    tenantId,
+    actor: args.actor ?? "system",
+    sink: args.escapeHatchAuditSink,
+  });
+  return createTenantDb(db, tenantId, "tenant", undefined, undefined, undefined, {
+    unsafeRaw:
+      entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
+    report,
+  });
 }
 
 /**
@@ -137,7 +166,13 @@ export async function runUserExport(args: RunUserExportArgs): Promise<UserExport
   const hookEntries: HookEntry[] = usages
     .map((u): HookEntry | null => {
       const opts = (u.options ?? {}) as { export?: UserDataExportHook }; // @cast-boundary engine-payload
-      return opts.export ? { entityName: u.entityName, exportHook: opts.export } : null;
+      return opts.export
+        ? {
+            entityName: u.entityName,
+            exportHook: opts.export,
+            escapeHatchReason: extensionUsageEscapeHatchReason(u),
+          }
+        : null;
     })
     .filter((x): x is HookEntry => x !== null);
 
@@ -147,7 +182,12 @@ export async function runUserExport(args: RunUserExportArgs): Promise<UserExport
   for (const tenantId of tenantList) {
     const entities: UserDataExportSnippet[] = [];
     for (const entry of hookEntries) {
-      const rawSnippet = await entry.exportHook({ db, registry, tenantId, userId });
+      const rawSnippet = await entry.exportHook({
+        db: buildHookDb(db, tenantId, entry, args),
+        registry,
+        tenantId,
+        userId,
+      });
       if (rawSnippet === null) continue;
       const snippet = await decryptSnippetFields(registry, entry.entityName, rawSnippet);
       entities.push(snippet);
@@ -181,7 +221,7 @@ export async function runUserExport(args: RunUserExportArgs): Promise<UserExport
     const orphanEntities: UserDataExportSnippet[] = [];
     for (const entry of hookEntries) {
       const rawSnippet = await entry.exportHook({
-        db,
+        db: buildHookDb(db, SYSTEM_TENANT_ID_FOR_ORPHANS, entry, args),
         registry,
         tenantId: SYSTEM_TENANT_ID_FOR_ORPHANS,
         userId,

package/src/user-data-rights-defaults/__tests__/bundled-entities.userdata-hooks.integration.test.ts

@@ -12,6 +12,8 @@
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
   type TestStack,
@@ -117,7 +119,7 @@ function uuid(suffix: number): string {
 
 function ctx(userId: string, overrides: Record<string, unknown> = {}) {
   return {
-    db: full.db,
+    db: createTenantDb(full.db, TENANT_A, "tenant"),
     registry: full.registry,
     tenantId: TENANT_A,
     userId,
@@ -132,10 +134,9 @@ async function rawSelect(sql: string, params: unknown[]) {
 }
 
 async function seedUser(id: string): Promise<void> {
-  const SYSTEM_TENANT = "00000000-0000-4000-8000-000000000001";
   await seedRow(full.db, userTable, {
     id,
-    tenantId: SYSTEM_TENANT,
+    tenantId: SYSTEM_TENANT_ID,
     email: `user-${id}@example.com`,
     passwordHash: "hashed-password",
     displayName: `User ${id}`,
@@ -404,11 +405,11 @@ describe("job-run userData-hooks (#799)", () => {
       `INSERT INTO store_job_runs
          (id, tenant_id, job_name, bull_job_id, status, payload, attempt, started_at, triggered_by_id)
        VALUES ($1::uuid, $2, 'app:job:export', $3, 'completed', '{"scope":"mine"}', 1, now(), $4)`,
-      [id, TENANT_A, `bull-${id}`, triggeredById],
+      [id, SYSTEM_TENANT_ID, `bull-${id}`, triggeredById],
     );
   }
 
-  test("export filters by triggeredById only (system-tenant rows)", async () => {
+  test("export filters by triggeredById only (rows live on SYSTEM_TENANT_ID, ctx bound to TENANT_A)", async () => {
     await seedRun(uuid(70), "jr-user-1");
     await seedRun(uuid(71), "jr-user-2");
     await seedRun(uuid(72), null);
@@ -428,7 +429,7 @@ describe("job-run userData-hooks (#799)", () => {
 describe("Presence-Gating: Source-Feature nicht gemountet → null/no-op statt Crash", () => {
   test("alle gegateten Hooks no-open auf dem Minimal-Stack", async () => {
     const minCtx = {
-      db: minimal.db,
+      db: createTenantDb(minimal.db, TENANT_A, "tenant"),
       registry: minimal.registry,
       tenantId: TENANT_A,
       userId: "any-user",

package/src/user-data-rights-defaults/__tests__/user-data-rights-defaults.integration.test.ts

@@ -13,7 +13,9 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { variantSuffix } from "@cosmicdrift/kumiko-framework/derivatives";
+import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import {
   createInMemoryFileProvider,
   deriveKey,
@@ -87,10 +89,9 @@ async function seedUser(id: string, overrides: Record<string, unknown> = {}): Pr
   // user-Entity ist tenant-agnostisch im Domain-Sinn, aber das DB-
   // Schema hat tenant_id-Spalte automatisch (Framework-Default).
   // Pragmatisch: SYSTEM_TENANT_ID fuer User-Rows in Tests.
-  const SYSTEM_TENANT = "00000000-0000-4000-8000-000000000001";
   await seedRow(stack.db, userTable, {
     id,
-    tenantId: SYSTEM_TENANT,
+    tenantId: SYSTEM_TENANT_ID,
     email: `user-${id}@example.com`,
     passwordHash: "hashed-password",
     displayName: `User ${id}`,
@@ -168,7 +169,7 @@ describe("S2.H1 :: userExportHook", () => {
     await seedUser(uuid(1001), { displayName: "Marc" });
 
     const result = await userExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, TENANT_A, "tenant"),
       registry: stack.registry,
       tenantId: TENANT_A,
       userId: uuid(1001),
@@ -189,7 +190,7 @@ describe("S2.H1 :: userExportHook", () => {
 
   test("returns null wenn User nicht existiert", async () => {
     const result = await userExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, TENANT_A, "tenant"),
       registry: stack.registry,
       tenantId: TENANT_A,
       userId: uuid(1002),
@@ -203,7 +204,12 @@ describe("S2.H1 :: userDeleteHook", () => {
     await seedUser(uuid(1003));
 
     await userDeleteHook(
-      { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: uuid(1003) },
+      {
+        db: createTenantDb(stack.db, TENANT_A, "tenant"),
+        registry: stack.registry,
+        tenantId: TENANT_A,
+        userId: uuid(1003),
+      },
       "delete",
     );
 
@@ -222,7 +228,12 @@ describe("S2.H1 :: userDeleteHook", () => {
     await seedUser(uuid(1004));
 
     await userDeleteHook(
-      { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: uuid(1004) },
+      {
+        db: createTenantDb(stack.db, TENANT_A, "tenant"),
+        registry: stack.registry,
+        tenantId: TENANT_A,
+        userId: uuid(1004),
+      },
       "anonymize",
     );
 
@@ -238,7 +249,12 @@ describe("S2.H1 :: userDeleteHook", () => {
     await seedUser(uuid(1005));
 
     await userDeleteHook(
-      { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: uuid(1005) },
+      {
+        db: createTenantDb(stack.db, TENANT_A, "tenant"),
+        registry: stack.registry,
+        tenantId: TENANT_A,
+        userId: uuid(1005),
+      },
       "delete",
     );
     const afterFirst = await fetchUser(uuid(1005));
@@ -247,7 +263,12 @@ describe("S2.H1 :: userDeleteHook", () => {
     // Zweiter Call: kein Crash + State unverändert
     await expect(
       userDeleteHook(
-        { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: uuid(1005) },
+        {
+          db: createTenantDb(stack.db, TENANT_A, "tenant"),
+          registry: stack.registry,
+          tenantId: TENANT_A,
+          userId: uuid(1005),
+        },
         "delete",
       ),
     ).resolves.toBeUndefined();
@@ -269,7 +290,7 @@ describe("S2.H2 :: fileRefExportHook", () => {
     await seedFileRef(uuid(102), TENANT_A, "user-files-1", "anschreiben.pdf");
 
     const result = await fileRefExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, TENANT_A, "tenant"),
       registry: stack.registry,
       tenantId: TENANT_A,
       userId: "user-files-1",
@@ -284,7 +305,7 @@ describe("S2.H2 :: fileRefExportHook", () => {
 
   test("returns null wenn User keine Files hat", async () => {
     const result = await fileRefExportHook({
-      db: stack.db,
+      db: createTenantDb(stack.db, TENANT_A, "tenant"),
       registry: stack.registry,
       tenantId: TENANT_A,
       userId: "ghost-user-no-files",
@@ -299,7 +320,12 @@ describe("S2.H2 :: fileRefDeleteHook", () => {
     await seedFileRef(uuid(202), TENANT_A, "user-delete-files", "f2.pdf");
 
     await fileRefDeleteHook(
-      { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: "user-delete-files" },
+      {
+        db: createTenantDb(stack.db, TENANT_A, "tenant"),
+        registry: stack.registry,
+        tenantId: TENANT_A,
+        userId: "user-delete-files",
+      },
       "delete",
     );
 
@@ -311,7 +337,12 @@ describe("S2.H2 :: fileRefDeleteHook", () => {
     await seedFileRef(uuid(203), TENANT_A, "user-anon-files", "shared.pdf");
 
     await fileRefDeleteHook(
-      { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: "user-anon-files" },
+      {
+        db: createTenantDb(stack.db, TENANT_A, "tenant"),
+        registry: stack.registry,
+        tenantId: TENANT_A,
+        userId: "user-anon-files",
+      },
       "anonymize",
     );
 
@@ -329,7 +360,12 @@ describe("S2.H2 :: fileRefDeleteHook", () => {
 
     // Tenant A loescht alle Files von "shared-user"
     await fileRefDeleteHook(
-      { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: "shared-user" },
+      {
+        db: createTenantDb(stack.db, TENANT_A, "tenant"),
+        registry: stack.registry,
+        tenantId: TENANT_A,
+        userId: "shared-user",
+      },
       "delete",
     );
 
@@ -345,7 +381,12 @@ describe("S2.H2 :: fileRefDeleteHook", () => {
     await seedFileRef(uuid(401), TENANT_A, "user-idem-files", "f.pdf");
 
     await fileRefDeleteHook(
-      { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: "user-idem-files" },
+      {
+        db: createTenantDb(stack.db, TENANT_A, "tenant"),
+        registry: stack.registry,
+        tenantId: TENANT_A,
+        userId: "user-idem-files",
+      },
       "delete",
     );
     const afterFirst = await fetchFileRefs(TENANT_A, "user-idem-files");
@@ -354,7 +395,12 @@ describe("S2.H2 :: fileRefDeleteHook", () => {
     // Zweiter Call: kein Crash + State weiter 0 Files
     await expect(
       fileRefDeleteHook(
-        { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: "user-idem-files" },
+        {
+          db: createTenantDb(stack.db, TENANT_A, "tenant"),
+          registry: stack.registry,
+          tenantId: TENANT_A,
+          userId: "user-idem-files",
+        },
         "delete",
       ),
     ).resolves.toBeUndefined();
@@ -398,7 +444,7 @@ describe("S2.H2 :: fileRefDeleteHook — GDPR derivatives survive forget (issue
 
     await fileRefDeleteHook(
       {
-        db: stack.db,
+        db: createTenantDb(stack.db, TENANT_A, "tenant"),
         registry: stack.registry,
         tenantId: TENANT_A,
         userId,
@@ -428,7 +474,7 @@ describe("S2.H2 :: fileRefDeleteHook — GDPR derivatives survive forget (issue
 
     await fileRefDeleteHook(
       {
-        db: stack.db,
+        db: createTenantDb(stack.db, TENANT_A, "tenant"),
         registry: stack.registry,
         tenantId: TENANT_A,
         userId,
@@ -459,7 +505,7 @@ describe("S2.H2 :: fileRefDeleteHook — GDPR derivatives survive forget (issue
     await expect(
       fileRefDeleteHook(
         {
-          db: stack.db,
+          db: createTenantDb(stack.db, TENANT_A, "tenant"),
           registry: stack.registry,
           tenantId: TENANT_A,
           userId,

package/src/user-data-rights-defaults/hooks/api-token.userdata-hook.ts

@@ -1,4 +1,3 @@
-import { deleteMany, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
 import { apiTokenTable } from "../../personal-access-tokens";
 import { featureMounted } from "./feature-mounted";
@@ -11,7 +10,7 @@ import { featureMounted } from "./feature-mounted";
 
 export const apiTokenExportHook: UserDataExportHook = async (ctx) => {
   if (!featureMounted(ctx, "personal-access-tokens")) return null;
-  const rows = await selectMany<Record<string, unknown>>(ctx.db, apiTokenTable, {
+  const rows = await ctx.db.selectMany(apiTokenTable, {
     userId: ctx.userId,
     tenantId: ctx.tenantId,
   });
@@ -33,5 +32,5 @@ export const apiTokenExportHook: UserDataExportHook = async (ctx) => {
 export const apiTokenDeleteHook: UserDataDeleteHook = async (ctx) => {
   // skip: personal-access-tokens not mounted — its table doesn't exist, nothing to erase.
   if (!featureMounted(ctx, "personal-access-tokens")) return;
-  await deleteMany(ctx.db, apiTokenTable, { userId: ctx.userId, tenantId: ctx.tenantId });
+  await ctx.db.deleteMany(apiTokenTable, { userId: ctx.userId, tenantId: ctx.tenantId });
 };