@cosmicdrift/kumiko-bundled-features 0.319.0 → 0.321.0

package/src/subscription-stripe/__tests__/plugin-methods.test.ts

@@ -26,6 +26,7 @@ import {
   createStripePortalSession,
   createStripePriceCache,
   createStripeRetrievePrices,
+  createStripeRetrieveSubscription,
 } from "../plugin-methods";
 import type { StripeCtxRuntime } from "../runtime";
 
@@ -830,3 +831,119 @@ describe("createStripePlanSwitchSession", () => {
     expect(retrieveMock).not.toHaveBeenCalled();
   });
 });
+
+// =============================================================================
+// retrieveSubscription — sync-subscriptions backfill, same status/tier/
+// period-end/cancel_at mapping as verify-webhook.ts's mapStripeSubscriptionState.
+// =============================================================================
+
+const PRICE_TO_TIER = { price_retrieve_pro: "pro" };
+
+function stripeSubscriptionForRetrieve(overrides: Record<string, unknown> = {}) {
+  return stripeSubscription({
+    status: "active",
+    items: {
+      data: [
+        {
+          id: "si_001",
+          price: stripePrice({ id: "price_retrieve_pro" }),
+          quantity: 1,
+          current_period_end: 1_800_000_000,
+        },
+      ],
+    },
+    cancel_at: null,
+    cancel_at_period_end: false,
+    ...overrides,
+  });
+}
+
+describe("createStripeRetrieveSubscription", () => {
+  test("maps a live subscription to a ProviderSubscriptionSnapshot", async () => {
+    const stripe = buildStripe();
+    spyOn(stripe.subscriptions, "retrieve").mockResolvedValue(stripeSubscriptionForRetrieve());
+    const retrieve = createStripeRetrieveSubscription(ctxRuntime(stripe), {
+      priceToTier: PRICE_TO_TIER,
+    });
+
+    const result = await retrieve(stubCtx, "sub_switch_001");
+
+    expect(result).toEqual({
+      providerCustomerId: "cus_switch_001",
+      providerSubscriptionId: "sub_switch_001",
+      status: "active",
+      tier: "pro",
+      currentPeriodEnd: "2027-01-15T08:00:00Z",
+      cancelAt: null,
+      rawPayload: JSON.stringify(stripeSubscriptionForRetrieve()),
+    });
+  });
+
+  test("a resource_missing StripeInvalidRequestError resolves to null instead of throwing", async () => {
+    const stripe = buildStripe();
+    spyOn(stripe.subscriptions, "retrieve").mockRejectedValue(
+      new Stripe.errors.StripeInvalidRequestError({
+        message: "No such subscription: 'sub_gone'",
+        code: "resource_missing",
+      }),
+    );
+    const retrieve = createStripeRetrieveSubscription(ctxRuntime(stripe), {
+      priceToTier: PRICE_TO_TIER,
+    });
+
+    expect(await retrieve(stubCtx, "sub_gone")).toBeNull();
+  });
+
+  test("an unmapped priceId resolves to null (same as verify-webhook's silent-drop)", async () => {
+    const stripe = buildStripe();
+    spyOn(stripe.subscriptions, "retrieve").mockResolvedValue(
+      stripeSubscriptionForRetrieve({
+        items: {
+          data: [
+            {
+              id: "si_001",
+              price: stripePrice({ id: "price_unmapped" }),
+              quantity: 1,
+              current_period_end: 1_800_000_000,
+            },
+          ],
+        },
+      }),
+    );
+    const retrieve = createStripeRetrieveSubscription(ctxRuntime(stripe), {
+      priceToTier: PRICE_TO_TIER,
+    });
+
+    expect(await retrieve(stubCtx, "sub_switch_001")).toBeNull();
+  });
+
+  test("a non-resource_missing Stripe error rethrows", async () => {
+    const stripe = buildStripe();
+    spyOn(stripe.subscriptions, "retrieve").mockRejectedValue(
+      new Stripe.errors.StripeInvalidRequestError({
+        message: "rate limited",
+        code: "rate_limit",
+      }),
+    );
+    const retrieve = createStripeRetrieveSubscription(ctxRuntime(stripe), {
+      priceToTier: PRICE_TO_TIER,
+    });
+
+    await expect(retrieve(stubCtx, "sub_switch_001")).rejects.toBeInstanceOf(
+      Stripe.errors.StripeInvalidRequestError,
+    );
+  });
+
+  test("a scheduled cancel_at is mapped through", async () => {
+    const stripe = buildStripe();
+    spyOn(stripe.subscriptions, "retrieve").mockResolvedValue(
+      stripeSubscriptionForRetrieve({ cancel_at: 1_850_000_000 }),
+    );
+    const retrieve = createStripeRetrieveSubscription(ctxRuntime(stripe), {
+      priceToTier: PRICE_TO_TIER,
+    });
+
+    const result = await retrieve(stubCtx, "sub_switch_001");
+    expect(result?.cancelAt).toBe("2028-08-16T00:53:20Z");
+  });
+});

package/src/subscription-stripe/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.320.0",
+    "type": "fix",
+    "title": "subscription-stripe narrows a recurring price interval to a closed union instead of widening on an unrecognized Stripe value",
+    "detail": "stripe >= 22.5 widened Recurring.Interval to an open union. mapStripePrice now maps anything outside RecurringInterval (\"day\" | \"week\" | \"month\" | \"year\") to null via isKnownRecurringInterval, the same as a one-off price, instead of letting an unrecognized interval leak into ProviderPrice untyped. stripe bumped to 22.6.2. Closes #3312."
+  },
   {
     "version": "0.319.0",
     "type": "fix",

package/src/subscription-stripe/feature.ts

@@ -53,6 +53,7 @@ import {
   createStripePortalSession,
   createStripePriceCache,
   createStripeRetrievePrices,
+  createStripeRetrieveSubscription,
 } from "./plugin-methods";
 import { createStripeRuntimes } from "./runtime";
 import { verifyAndParseStripeWebhook } from "./verify-webhook";
@@ -144,7 +145,7 @@ export function createSubscriptionStripeFeature(
   validateOneOffPriceIds(options.oneOffPriceIds ?? []);
   return defineFeature(SUBSCRIPTION_STRIPE_FEATURE, (r) => {
     r.describe(
-      'Stripe payment provider plugin for `billing-foundation`. Reads its Stripe API key + webhook secret from system config keys with `backing:"secrets"` (envelope-encrypted in the secrets store under the system tenant) and a `billingLive` **system config** flag — all at runtime, so keys rotate and prod goes live without a redeploy. The `mask` on each key derives the sysadmin settings screen + nav, so no app wires a hand-written config UI. Mount via `createSubscriptionStripeFeature({ priceToTier })`; the optional `apiKey`/`webhookSecret` options are env→secrets bridge fallbacks. The plugin always mounts — `createCheckoutSession` throws `feature_disabled` unless `billingLive` is true, so sk_test_ keys in prod never produce a live checkout. Implements webhook verify, checkout, portal, cancel, `retrievePrices` (10-minute TTL-cached price lookup for the billing-plans catalog) and `createPlanSwitchSession` (auto-provisions a Customer-Portal configuration for switching an existing subscription to another plan tier — each tier needs its own Stripe product), plus `isBillingEnabled` (billingLive + an api-key existence probe, no secret read).',
+      'Stripe payment provider plugin for `billing-foundation`. Reads its Stripe API key + webhook secret from system config keys with `backing:"secrets"` (envelope-encrypted in the secrets store under the system tenant) and a `billingLive` **system config** flag — all at runtime, so keys rotate and prod goes live without a redeploy. The `mask` on each key derives the sysadmin settings screen + nav, so no app wires a hand-written config UI. Mount via `createSubscriptionStripeFeature({ priceToTier })`; the optional `apiKey`/`webhookSecret` options are env→secrets bridge fallbacks. The plugin always mounts — `createCheckoutSession` throws `feature_disabled` unless `billingLive` is true, so sk_test_ keys in prod never produce a live checkout. Implements webhook verify, checkout, portal, cancel, `retrievePrices` (10-minute TTL-cached price lookup for the billing-plans catalog), `createPlanSwitchSession` (auto-provisions a Customer-Portal configuration for switching an existing subscription to another plan tier — each tier needs its own Stripe product), `retrieveSubscription` (live provider-side snapshot for the `sync-subscriptions` backfill job, mapped identically to the webhook path), plus `isBillingEnabled` (billingLive + an api-key existence probe, no secret read).',
     );
     r.uiHints({
       displayLabel: "Billing · Stripe",
@@ -234,6 +235,9 @@ export function createSubscriptionStripeFeature(
       oneOffPriceIds: options.oneOffPriceIds ?? [],
       isBillingEnabled: runtimes.ctx.isBillingEnabled,
       retrievePrices: createStripeRetrievePrices(runtimes.ctx, priceCache),
+      retrieveSubscription: createStripeRetrieveSubscription(runtimes.ctx, {
+        priceToTier: options.priceToTier ?? {},
+      }),
       createPlanSwitchSession: createStripePlanSwitchSession(
         runtimes.ctx,
         priceCache,

package/src/subscription-stripe/plugin-methods.ts

@@ -18,6 +18,7 @@ import { createHash } from "node:crypto";
 import {
   KNOWN_RECURRING_INTERVALS,
   type ProviderPrice,
+  type ProviderSubscriptionSnapshot,
   type RecurringInterval,
   type SubscriptionProviderPlugin,
 } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
@@ -25,6 +26,7 @@ import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 import { ConflictError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import Stripe from "stripe";
 import type { StripeCtxRuntime } from "./runtime";
+import { mapStripeSubscriptionState } from "./verify-webhook";
 
 // =============================================================================
 // createCheckoutSession
@@ -127,6 +129,57 @@ export function createStripeCancelSubscription(runtime: StripeCtxRuntime) {
   };
 }
 
+// =============================================================================
+// retrieveSubscription — live provider-side snapshot for the
+// sync-subscriptions backfill job
+// =============================================================================
+//
+// Same status/tier/period-end/cancel_at mapping as verify-webhook.ts, via
+// the shared mapStripeSubscriptionState — the sync path and the webhook path
+// must never disagree on what a given Stripe subscription object means.
+
+export type StripeRetrieveSubscriptionOptions = {
+  readonly priceToTier: Readonly<Record<string, string>>;
+};
+
+function isResourceMissingStripeError(error: unknown): boolean {
+  return (
+    error instanceof Stripe.errors.StripeInvalidRequestError && error.code === "resource_missing"
+  );
+}
+
+export function createStripeRetrieveSubscription(
+  runtime: StripeCtxRuntime,
+  { priceToTier }: StripeRetrieveSubscriptionOptions,
+) {
+  return async (
+    ctx: HandlerContext,
+    providerSubscriptionId: string,
+  ): Promise<ProviderSubscriptionSnapshot | null> => {
+    const stripe = await runtime.clientForCtx(ctx);
+    let subscription: Stripe.Subscription;
+    try {
+      subscription = await stripe.subscriptions.retrieve(providerSubscriptionId);
+    } catch (error) {
+      if (isResourceMissingStripeError(error)) return null;
+      throw error;
+    }
+
+    const state = mapStripeSubscriptionState(subscription, priceToTier);
+    if (!state) return null;
+
+    return {
+      providerCustomerId:
+        typeof subscription.customer === "string"
+          ? subscription.customer
+          : subscription.customer.id,
+      providerSubscriptionId: subscription.id,
+      ...state,
+      rawPayload: JSON.stringify(subscription),
+    };
+  };
+}
+
 // =============================================================================
 // retrievePrices — bulk price lookup for the billing-plans catalog
 // =============================================================================

package/src/subscription-stripe/verify-webhook.ts

@@ -137,32 +137,14 @@ export function verifyAndParseStripeWebhook(
       return null;
     }
 
-    // 5. Price-to-tier-Mapping. Stripe-subscription hat items[0].price.id.
-    const priceId = sub.items.data[0]?.price.id;
-    if (!priceId) {
+    // 5+6. Price-to-tier-Mapping + status/period-end/cancel_at — shared with
+    //      plugin-methods.ts's createStripeRetrieveSubscription so both the
+    //      webhook and the sync-subscriptions backfill map Stripe state
+    //      identically.
+    const state = mapStripeSubscriptionState(sub, options.priceToTier);
+    if (!state) {
       return null;
     }
-    const tier = options.priceToTier[priceId];
-    if (!tier) {
-      // Price-id nicht im Mapping → App-Owner hat den Stripe-price
-      // angelegt aber nicht zur tier zugeordnet. Drop silent.
-      return null;
-    }
-
-    // 6. Status-Mapping + period-end. Stripe hat den period-end seit
-    //    2024 vom subscription-level auf item-level migriert (=
-    //    subscription.items.data[i].current_period_end). Wir lesen
-    //    das vom ersten item; multi-item-subs (Add-Ons) sind kein
-    //    Phase-5-Scope.
-    const status = mapStripeStatus(sub.status);
-    const periodEndUnixSec = sub.items.data[0]?.current_period_end ?? 0;
-    // Stripe returns Unix-seconds; Temporal.Instant.fromEpochMilliseconds
-    // expects ms. Multiply, then ISO. (No-Date-API-Guard forbids
-    // `new Date()` — static import above, not the ambient global, see #1490.)
-    const currentPeriodEnd = Temporal.Instant.fromEpochMilliseconds(
-      periodEndUnixSec * 1000,
-    ).toString();
-    const cancelAt = stripeCancelAtIso(sub, currentPeriodEnd);
 
     return {
       providerEventId: event.id,
@@ -171,15 +153,57 @@ export function verifyAndParseStripeWebhook(
       tenantId,
       providerCustomerId: typeof sub.customer === "string" ? sub.customer : sub.customer.id,
       providerSubscriptionId: sub.id,
-      status,
-      tier,
-      currentPeriodEnd,
-      cancelAt,
+      ...state,
       rawPayload: JSON.stringify(event),
     };
   };
 }
 
+// =============================================================================
+// Shared subscription-state mapping (webhook + retrieveSubscription)
+// =============================================================================
+
+export type MappedStripeSubscriptionState = {
+  readonly status: SubscriptionStatus;
+  readonly tier: string;
+  readonly currentPeriodEnd: string;
+  readonly cancelAt: string | null;
+};
+
+/** Maps a Stripe subscription's price/status/period-end/cancel_at onto the
+ *  foundation's normalized shape. Null when the subscription's price isn't
+ *  in `priceToTier` (the app owner created the Stripe price but never
+ *  mapped it to a tier) or the item has no price id at all. */
+export function mapStripeSubscriptionState(
+  sub: Pick<Stripe.Subscription, "status" | "items" | "cancel_at" | "cancel_at_period_end">,
+  priceToTier: Readonly<Record<string, string>>,
+): MappedStripeSubscriptionState | null {
+  const priceId = sub.items.data[0]?.price.id;
+  if (!priceId) {
+    return null;
+  }
+  const tier = priceToTier[priceId];
+  if (!tier) {
+    return null;
+  }
+
+  // Since 2024 Stripe reports period-end per item
+  // (subscription.items.data[i].current_period_end), not per subscription.
+  // We read the first item; multi-item subscriptions (add-ons) aren't
+  // supported.
+  const status = mapStripeStatus(sub.status);
+  const periodEndUnixSec = sub.items.data[0]?.current_period_end ?? 0;
+  // Stripe returns Unix-seconds; Temporal.Instant.fromEpochMilliseconds
+  // expects ms. Multiply, then ISO. (No-Date-API-Guard forbids
+  // `new Date()` — static import above, not the ambient global, see #1490.)
+  const currentPeriodEnd = Temporal.Instant.fromEpochMilliseconds(
+    periodEndUnixSec * 1000,
+  ).toString();
+  const cancelAt = stripeCancelAtIso(sub, currentPeriodEnd);
+
+  return { status, tier, currentPeriodEnd, cancelAt };
+}
+
 // =============================================================================
 // Helpers
 // =============================================================================

package/src/tenant-handover/__tests__/claim.integration.test.ts

@@ -20,8 +20,13 @@ import {
   type EntityDefinition,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { loadAggregate } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  AGGREGATE_TRANSFER_STREAM_TYPE,
+  AGGREGATE_TRANSFERRED_EVENT_TYPE,
+  loadAggregate,
+} from "@cosmicdrift/kumiko-framework/event-store";
 import { fileRefEntity, fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
+import { rebuildProjection } from "@cosmicdrift/kumiko-framework/pipeline";
 import {
   createTestUser,
   setupTestStack,
@@ -387,7 +392,7 @@ async function seedFileRef(
   tenantId: TenantId,
   entityType: string,
   entityId: string,
-): Promise<void> {
+): Promise<string> {
   const user = createSystemUser(tenantId);
   const db = createTenantDb(stack.db, tenantId, "system");
   const result = await fileRefCrud.create(
@@ -404,6 +409,7 @@ async function seedFileRef(
     db,
   );
   if (!result.isSuccess) throw new Error(`seedFileRef failed: ${result.error.message}`);
+  return String(result.data.id);
 }
 
 function grantFor(rowId: string): string {
@@ -429,8 +435,8 @@ describe("tenant-handover :: claim", () => {
   test("claims the root, its parentRef-linked child, and both attached files into the caller's tenant, leaving an unrelated run of the same type untouched", async () => {
     const runId = await seedRun(SOURCE_TENANT, "my run");
     const photoId = await seedPhoto(SOURCE_TENANT, runId, "front");
-    await seedFileRef(SOURCE_TENANT, "run", runId);
-    await seedFileRef(SOURCE_TENANT, "photo", photoId);
+    const runFileRefId = await seedFileRef(SOURCE_TENANT, "run", runId);
+    const photoFileRefId = await seedFileRef(SOURCE_TENANT, "photo", photoId);
 
     // A second, unrelated run of the SAME entity type, still in the source
     // tenant — proves the claim moves only the identified run's rows, not
@@ -491,6 +497,58 @@ describe("tenant-handover :: claim", () => {
     // The unrelated run (same entity type, different row) never moved.
     expect(await readTenantId("handover_run", otherRunId)).toBe(SOURCE_TENANT);
     expect(await readTenantId("handover_photo", otherPhotoId)).toBe(SOURCE_TENANT);
+
+    // The event store's own transfer primitive left its own audit trail too:
+    // exactly one aggregate.transferred system event per moved aggregate,
+    // landed in the destination tenant.
+    const transferEvents = await executeRawQuery<{ payload: Record<string, unknown> }>(
+      stack.db,
+      `SELECT payload FROM kumiko_events WHERE tenant_id = $1 AND aggregate_type = $2 AND type = $3`,
+      [dest.tenantId, AGGREGATE_TRANSFER_STREAM_TYPE, AGGREGATE_TRANSFERRED_EVENT_TYPE],
+    );
+    expect(transferEvents).toHaveLength(4);
+    const byMovedAggregateId = new Map(
+      transferEvents.map((row) => [row.payload["aggregateId"], row.payload]),
+    );
+    for (const [aggregateId, aggregateType] of [
+      [runId, "run"],
+      [photoId, "photo"],
+      [runFileRefId, "fileRef"],
+      [photoFileRefId, "fileRef"],
+    ] as const) {
+      expect(byMovedAggregateId.get(aggregateId)).toMatchObject({
+        aggregateType,
+        aggregateId,
+        sourceTenantId: SOURCE_TENANT,
+        destinationTenantId: dest.tenantId,
+      });
+    }
+
+    // A projection rebuild of the root entity after the claim still resolves
+    // it under the destination tenant with the same content — the transfer
+    // didn't leave the projection and the event store out of sync.
+    await rebuildProjection("handover-fixtures:projection:run-entity", {
+      db: stack.db,
+      registry: stack.registry,
+    });
+    expect(await readTenantId("handover_run", runId)).toBe(dest.tenantId);
+    const rebuiltRow = await executeRawQuery<{ name: string }>(
+      stack.db,
+      `SELECT name FROM handover_run WHERE id = $1`,
+      [runId],
+    );
+    expect(rebuiltRow[0]?.name).toBe("my run");
+
+    // The event store's version bookkeeping survived the move: a normal
+    // write against the claimed root in its new tenant still succeeds.
+    const destDb = createTenantDb(stack.db, dest.tenantId, "system");
+    const destUser = createSystemUser(dest.tenantId);
+    const followUpWrite = await runCrud.update(
+      { id: runId, version: 1, changes: { name: "renamed after claim" } },
+      destUser,
+      destDb,
+    );
+    expect(followUpWrite.isSuccess).toBe(true);
   });
 
   // kumiko-framework#3088: before this, resolveChildCandidates only knew

package/src/tenant-handover/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.321.0",
+    "type": "improvement",
+    "title": "Claim now moves event-store ownership through transferAggregateStreams instead of raw SQL",
+    "detail": "move-entity-graph.ts no longer runs its own `UPDATE kumiko_events` /\n`UPDATE kumiko_snapshots` against the event store — it calls the\nframework's `transferAggregateStreams` per aggregate type, threading the\nclaiming user's id as `transferredBy`. Archive markers now move with the\nstream (previously left behind under the source tenant). Each moved\naggregate gets its own `kumiko:system:aggregate.transferred` audit event\nin the destination tenant, in addition to the existing\n`tenant-handover:event:claimed` summary event.",
+    "migration": "No action needed — the claim API and its response shape are unchanged."
+  },
   {
     "version": "0.313.0",
     "type": "fix",

package/src/tenant-handover/handlers/claim.write.ts

@@ -82,6 +82,7 @@ export function createClaimTenantHandoverHandler(opts: ClaimTenantHandoverOption
             rootRowId: subject,
             sourceTenantId: expectedAnchor,
             destinationTenantId,
+            transferredBy: event.user.id,
           });
 
           // Own aggregate, decoupled from the transferred root's stream (see

package/src/tenant-handover/move-entity-graph.ts

@@ -1,9 +1,12 @@
 // The actual ownership change (kumiko-framework#3035): raw SQL against the
-// event store + read-model tables, because moving a row across the tenant
-// boundary is exactly the kind of write the framework's entity write map
-// cannot express (it is single-tenant-scoped by design — that boundary is
-// the whole point of `assertTenantMatch`). This is the framework's OWN
-// declared operation, not a consumer's `acknowledgeCrossTenant` escape.
+// read-model tables, because moving a row across the tenant boundary is
+// exactly the kind of write the framework's entity write map cannot express
+// (it is single-tenant-scoped by design — that boundary is the whole point
+// of `assertTenantMatch`). This is the framework's OWN declared operation,
+// not a consumer's `acknowledgeCrossTenant` escape. The event-store side of
+// the move (kumiko_events/kumiko_snapshots/kumiko_archived_streams) is the
+// framework's own `transferAggregateStreams` primitive
+// — see event-store/transfer.ts for why that boundary is owned there instead.
 //
 // Every statement here runs inside the calling write handler's own
 // transaction (HandlerContext.db is transaction-scoped for the handler's
@@ -28,12 +31,11 @@ import {
 } from "@cosmicdrift/kumiko-framework/db";
 import { MAX_TRANSFER_DEPTH, type Registry } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
+import { transferAggregateStreams } from "@cosmicdrift/kumiko-framework/event-store";
 import { transferTenantStorageUsage } from "@cosmicdrift/kumiko-framework/files";
 import { resolveTransferAdjacency, type TransferEdge } from "./transfer-graph";
 
 const FILE_REFS_TABLE = "file_refs";
-const EVENTS_TABLE = "kumiko_events";
-const SNAPSHOTS_TABLE = "kumiko_snapshots";
 
 // The commitAnchor statement itself: spends the anchor (WHERE tenant_id =
 // expected) AND performs the ownership write (SET tenant_id = destination)
@@ -57,34 +59,6 @@ export async function moveRootRow(args: {
   return rows.length === 1;
 }
 
-async function moveEventHistory(args: {
-  readonly db: DbRunner;
-  readonly aggregateType: string;
-  readonly aggregateIds: readonly string[];
-  readonly sourceTenantId: string;
-  readonly destinationTenantId: string;
-}): Promise<void> {
-  // skip: an empty id list has nothing to move — both callers already
-  // filter to a non-empty list before calling, this only guards a future
-  // caller that forgets to.
-  if (args.aggregateIds.length === 0) return;
-  await executeRawQuery(
-    args.db,
-    `UPDATE ${EVENTS_TABLE} SET tenant_id = $1 ` +
-      `WHERE tenant_id = $2 AND aggregate_type = $3 AND aggregate_id = ANY($4)`,
-    [args.destinationTenantId, args.sourceTenantId, args.aggregateType, args.aggregateIds],
-  );
-  // Snapshots are a pure read-performance cache (event-store/snapshot.ts) —
-  // dropped rather than rewritten, forcing a full replay from the just-moved
-  // events on next read instead of carrying the snapshot's own generation
-  // bookkeeping across the tenant boundary.
-  await executeRawQuery(
-    args.db,
-    `DELETE FROM ${SNAPSHOTS_TABLE} WHERE tenant_id = $1 AND aggregate_id = ANY($2)`,
-    [args.sourceTenantId, args.aggregateIds],
-  );
-}
-
 // Moves the file_refs row itself PLUS the fileRef aggregate's own event
 // history + storage-usage counters — fileRef is a standard ES entity (see
 // files-storage-tracking.md), so without those two follow-ups a later write
@@ -98,6 +72,7 @@ async function moveFileRefs(args: {
   readonly entityIds: readonly string[];
   readonly sourceTenantId: string;
   readonly destinationTenantId: string;
+  readonly transferredBy: string;
 }): Promise<number> {
   if (args.entityIds.length === 0) return 0;
   const rows = await executeRawQuery<{ id: string }>(
@@ -109,8 +84,8 @@ async function moveFileRefs(args: {
   const movedIds = rows.map((row) => row.id);
   if (movedIds.length === 0) return 0;
 
-  // Must run before moveEventHistory rewrites these events' tenant_id — see
-  // transferTenantStorageUsage's own comment for why.
+  // Must run before transferAggregateStreams rewrites these events' tenant_id —
+  // see transferTenantStorageUsage's own comment for why.
   await transferTenantStorageUsage({
     db: args.db,
     registry: args.registry,
@@ -118,12 +93,12 @@ async function moveFileRefs(args: {
     sourceTenantId: args.sourceTenantId,
     destinationTenantId: args.destinationTenantId,
   });
-  await moveEventHistory({
-    db: args.db,
+  await transferAggregateStreams(args.db, {
     aggregateType: "fileRef",
     aggregateIds: movedIds,
     sourceTenantId: args.sourceTenantId,
     destinationTenantId: args.destinationTenantId,
+    transferredBy: args.transferredBy,
   });
   return movedIds.length;
 }
@@ -237,8 +212,17 @@ export async function moveTransferGraph(args: {
   readonly rootRowId: string;
   readonly sourceTenantId: string;
   readonly destinationTenantId: string;
+  readonly transferredBy: string;
 }): Promise<Readonly<Record<string, number>>> {
-  const { db, registry, rootEntityName, rootRowId, sourceTenantId, destinationTenantId } = args;
+  const {
+    db,
+    registry,
+    rootEntityName,
+    rootRowId,
+    sourceTenantId,
+    destinationTenantId,
+    transferredBy,
+  } = args;
   const movedCounts: Record<string, number> = { [rootEntityName]: 1 };
   const trackFileMove = (count: number) => {
     // skip: nothing moved (this entity had no attached files) — the audit
@@ -248,12 +232,12 @@ export async function moveTransferGraph(args: {
     movedCounts["fileRef"] = (movedCounts["fileRef"] ?? 0) + count;
   };
 
-  await moveEventHistory({
-    db,
+  await transferAggregateStreams(db, {
     aggregateType: rootEntityName,
     aggregateIds: [rootRowId],
     sourceTenantId,
     destinationTenantId,
+    transferredBy,
   });
   trackFileMove(
     await moveFileRefs({
@@ -263,6 +247,7 @@ export async function moveTransferGraph(args: {
       entityIds: [rootRowId],
       sourceTenantId,
       destinationTenantId,
+      transferredBy,
     }),
   );
 
@@ -317,12 +302,12 @@ export async function moveTransferGraph(args: {
         movedCounts[edge.entityName] = (movedCounts[edge.entityName] ?? 0) + childIds.length;
         discovered.push({ entityName: edge.entityName, rowIds: childIds });
 
-        await moveEventHistory({
-          db,
+        await transferAggregateStreams(db, {
           aggregateType: edge.entityName,
           aggregateIds: childIds,
           sourceTenantId,
           destinationTenantId,
+          transferredBy,
         });
         trackFileMove(
           await moveFileRefs({
@@ -332,6 +317,7 @@ export async function moveTransferGraph(args: {
             entityIds: childIds,
             sourceTenantId,
             destinationTenantId,
+            transferredBy,
           }),
         );
       }

package/src/user-data-rights/__tests__/anonymous-deletion.integration.test.ts

@@ -75,6 +75,12 @@ afterAll(async () => {
 beforeEach(async () => {
   verifyCalls.length = 0;
   await resetTestTables(stack.db, [userTable, tenantComplianceProfileTable, eventsTable]);
+  // request-deletion-by-email/confirm-deletion-by-token are `per: "ip"`
+  // rate-limited (10/60s). All calls here go through stack.http.raw with no
+  // socket address, so every test in this file lands in the same shared
+  // "unknown" IP bucket — flush it per test so one test's calls can't push
+  // a later, unrelated test over the cap.
+  await stack.redis.flushNamespace();
 });
 
 async function seedAlice(status: string = USER_STATUS.Active, email: string = ALICE_EMAIL) {
@@ -198,6 +204,11 @@ describe("anonymous deletion flow", () => {
     // instead of a single run (probabilistic test).
     for (let i = 0; i < 20; i++) {
       await resetTestTables(stack.db, [userTable, tenantComplianceProfileTable, eventsTable]);
+      // Both handlers below are `per: "ip"` rate-limited (10/60s); this loop's
+      // own 3 calls/iteration would otherwise trip that limiter well before
+      // the 20th repetition, which has nothing to do with the concurrency
+      // behaviour under test.
+      await stack.redis.flushNamespace();
       await seedAlice();
       verifyCalls.length = 0;
       await stack.http.raw("POST", "/api/write", {