@cosmicdrift/kumiko-framework 0.328.0 → 0.328.1

package/src/db/__tests__/assert-no-unreachable-live-rows.integration.test.ts

@@ -1,190 +0,0 @@
-// Runtime guard #722: before the rebuild swaps the shadow over the live table,
-// abort if a live row has NO event in the projection's source streams — a row
-// no replay can reconstruct (#498 ghost, direct-inserted without a .created
-// event), which the swap would silently drop.
-//
-// The guard is deliberately narrow (event EXISTENCE only, not a column diff):
-// the framework legitimately makes live diverge from a fresh replay in shipped
-// ways (blind-index erase→NULL, sensitive-strip, archived-stream wipe, the #494
-// backfill flow). Those rows all HAVE an event, so they are not ghosts and the
-// guard leaves them alone — proven by the "direct column-write" test below.
-
-import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
-import { asRawClient, insertOne, selectMany } from "../../db/query";
-import { createBooleanField, createEntity, createTextField, defineFeature } from "../../engine";
-import { createRegistry } from "../../engine/registry";
-import { archiveStream, createArchivedStreamsTable } from "../../event-store";
-import { rebuildProjection } from "../../pipeline";
-import { createProjectionStateTable } from "../../pipeline/projection-state";
-import { TestUsers, unsafeCreateEntityTable } from "../../stack";
-import { ensureTemporalPolyfill } from "../../time/polyfill";
-import { createEventStoreExecutor } from "../event-store-executor";
-import { buildEntityTable } from "../table-builder";
-import { createTenantDb, type TenantDb } from "../tenant-db";
-
-const userEntity = createEntity({
-  table: "read_unreachable_users",
-  fields: {
-    email: createTextField({ required: true, personal: false, reason: "test_fixture" }),
-    firstName: createTextField({ personal: false, reason: "test_fixture" }),
-    isEnabled: createBooleanField({ default: true }),
-  },
-  softDelete: true,
-});
-
-const userFeature = defineFeature("unreachabletest", (r) => {
-  r.entity("user", userEntity);
-});
-
-const userTable = buildEntityTable("user", userEntity);
-const projectionName = "unreachabletest:projection:user-entity";
-const registry = createRegistry([userFeature]);
-
-let testDb: BunTestDb;
-let tdb: TenantDb;
-const adminUser = TestUsers.admin;
-
-beforeAll(async () => {
-  await ensureTemporalPolyfill();
-  testDb = await createTestDb();
-  await unsafeCreateEntityTable(testDb.db, userEntity, "user");
-  await createArchivedStreamsTable(testDb.db);
-  await createProjectionStateTable(testDb.db);
-  tdb = createTenantDb(testDb.db, adminUser.tenantId);
-});
-
-afterAll(async () => {
-  await testDb.cleanup();
-});
-
-beforeEach(async () => {
-  await asRawClient(testDb.db).unsafe(
-    `TRUNCATE kumiko_events, kumiko_archived_streams, read_unreachable_users, kumiko_projections RESTART IDENTITY CASCADE`,
-  );
-});
-
-async function snapshotTable(): Promise<readonly Record<string, unknown>[]> {
-  const rows = await selectMany(
-    testDb.db,
-    userTable,
-    {},
-    { orderBy: { col: "id", direction: "asc" } },
-  );
-  return rows as readonly Record<string, unknown>[];
-}
-
-describe("assert-no-unreachable-live-rows / #722 ghost-row guard", () => {
-  test("clean executor-only projection rebuilds without firing the guard", async () => {
-    const crud = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
-    await crud.create({ email: "a@test.de", firstName: "Alice" }, adminUser, tdb);
-    await crud.create({ email: "b@test.de", firstName: "Bob" }, adminUser, tdb);
-    const before = await snapshotTable();
-
-    const result = await rebuildProjection(projectionName, { db: testDb.db, registry });
-
-    expect(result.eventsProcessed).toBe(2);
-    expect(result.columnDriftCount).toBe(0);
-    expect(await snapshotTable()).toEqual(before);
-  });
-
-  test("ghost row (no backing event) → swap aborts, live untouched", async () => {
-    const crud = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
-    const a = await crud.create({ email: "a@test.de", firstName: "Alice" }, adminUser, tdb);
-    if (!a.isSuccess) throw new Error("setup failed");
-
-    // Drift: clone the event-backed row into a second id WITHOUT appending an
-    // event — the #498 ghost. No replay can ever reconstruct it.
-    const [liveRow] = await selectMany(testDb.db, userTable, { id: a.data.id as string });
-    if (!liveRow) throw new Error("live row missing");
-    const ghostId = crypto.randomUUID();
-    // Deliberately bypass the EXECUTOR_ONLY brand: the whole point is to write
-    // the entity table WITHOUT going through the executor — the production bug
-    // the guard defends against.
-    const writable = userTable as unknown as Parameters<typeof insertOne>[1];
-    await insertOne(tdb, writable, { ...liveRow, id: ghostId, email: "ghost@test.de" });
-    expect(await snapshotTable()).toHaveLength(2);
-
-    await expect(rebuildProjection(projectionName, { db: testDb.db, registry })).rejects.toThrow(
-      // #915: exact count below the truncation limit, no misleading "+" suffix.
-      /^projection-rebuild ".*": 1 live rows in ".*" have no\s+event in the projection's source streams/,
-    );
-
-    // Swap never ran: both rows — including the ghost — survive.
-    const after = await snapshotTable();
-    expect(after).toHaveLength(2);
-    expect(after.map((r) => r["id"])).toContain(ghostId);
-  });
-
-  test("direct column-write on an event-backed row does NOT trip the guard", async () => {
-    // The row has a .created event, so it is not a ghost. Its column state was
-    // direct-written without an event (the #494 / blind-index-erase class) — the
-    // guard is event-existence-only and leaves it alone; the replay overwrites
-    // the column from the event, which is the intended, shipped behavior.
-    const crud = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
-    const a = await crud.create({ email: "a@test.de", firstName: "Alice" }, adminUser, tdb);
-    if (!a.isSuccess) throw new Error("setup failed");
-
-    await asRawClient(testDb.db).unsafe(
-      `UPDATE read_unreachable_users SET first_name = 'DirectWrite' WHERE id = $1`,
-      [a.data.id],
-    );
-
-    // No throw — the row is event-backed. Rebuild replays the create event.
-    // #916: the direct write IS reported as column drift (non-blocking) —
-    // this is the exact #494 healing case the guard leaves to replay.
-    const result = await rebuildProjection(projectionName, { db: testDb.db, registry });
-    expect(result.columnDriftCount).toBe(1);
-
-    const [rebuilt] = await selectMany(testDb.db, userTable, { id: a.data.id as string });
-    expect(rebuilt?.["email"]).toBe("a@test.de");
-    // The direct write is overwritten by the replay — deliberately allowed.
-    expect(rebuilt?.["firstName"]).toBe("Alice");
-  });
-
-  test("columnDriftCount reports the TRUE total, not capped at the 20-row sample limit", async () => {
-    const crud = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
-    const created = await Promise.all(
-      Array.from({ length: 21 }, (_, i) =>
-        crud.create({ email: `u${i}@test.de`, firstName: `Name${i}` }, adminUser, tdb),
-      ),
-    );
-    for (const c of created) {
-      if (!c.isSuccess) throw new Error("setup failed");
-      await asRawClient(testDb.db).unsafe(
-        `UPDATE read_unreachable_users SET first_name = 'DirectWrite' WHERE id = $1`,
-        [c.data.id],
-      );
-    }
-
-    const result = await rebuildProjection(projectionName, { db: testDb.db, registry });
-
-    // #916: the sample query is LIMITed to 20 rows, but the count must reflect
-    // all 21 — a min(actual, 20) would silently understate severity to ops.
-    expect(result.columnDriftCount).toBe(21);
-  });
-
-  test("archived stream (fw#832 tombstone) does NOT trip the guard", async () => {
-    // archiveStream never deletes the .created event — projection rebuild
-    // deliberately excludes archived streams from replay (fw#832, see
-    // projection-rebuild.ts), so the row is wiped from live on swap. The
-    // guard only checks event EXISTENCE, not replay-inclusion, so it must
-    // not fire — this is the shipped tombstone behavior, not drift.
-    const crud = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
-    const a = await crud.create({ email: "a@test.de", firstName: "Alice" }, adminUser, tdb);
-    if (!a.isSuccess) throw new Error("setup failed");
-
-    await archiveStream(testDb.db, {
-      tenantId: adminUser.tenantId,
-      aggregateId: a.data.id as string,
-      aggregateType: "user",
-      archivedBy: adminUser.id,
-    });
-
-    // No throw — the row is event-backed despite being archived.
-    const result = await rebuildProjection(projectionName, { db: testDb.db, registry });
-
-    expect(result.eventsProcessed).toBe(0);
-    expect(await snapshotTable()).toHaveLength(0);
-  });
-});

package/src/db/__tests__/big-int-field.test.ts

@@ -1,132 +0,0 @@
-// Unit-Tests fuer den BigInt-Field-Type — Atom 1a aus dem User-Data-
-// Rights Async-Export-Plan.
-//
-// Pinst:
-//   - createBigIntField liefert FieldDefinition.type === "bigInt"
-//   - buildEntityTable mappt auf bigint(name, mode:"number"), nicht
-//     integer (32-bit) → kein silent 2 GB-Cap
-//   - Zod-Schema akzeptiert int + safe-integer + lehnt non-int + Float
-//     + non-safe-integer ab
-//   - required + sortable + filterable + default reisen durch
-//
-// Echter DB-Roundtrip-Test (Insert >2^31, Select, identisch zurueck)
-// kommt mit Atom 1b sobald `exportJobEntity.bytesWritten` auf bigInt
-// migriert ist + die existing integration-Tests die Tabelle wieder
-// einrichten — pinst dort auf realer Postgres + Drizzle-customType-
-// Path statt parallel-mock hier.
-
-import { describe, expect, test } from "bun:test";
-import { createBigIntField, createEntity, createNumberField } from "../../engine";
-import { buildInsertSchema } from "../../engine/schema-builder";
-import { buildEntityTable } from "../table-builder";
-
-function colByName(table: unknown, dbName: string) {
-  const cols = (
-    table as { columns?: ReadonlyArray<{ name: string; notNull?: boolean; pgType?: string }> }
-  ).columns;
-  if (!cols) throw new Error("Table has no columns metadata");
-  for (const c of cols) {
-    if (c.name === dbName) {
-      return { name: c.name, notNull: c.notNull, columnType: c.pgType, dataType: c.pgType };
-    }
-  }
-  throw new Error(`Column ${dbName} not found in table`);
-}
-
-describe("createBigIntField factory", () => {
-  test("liefert FieldDef mit type='bigInt' + default required=false", () => {
-    const f = createBigIntField();
-    expect(f.type).toBe("bigInt");
-    expect(f.required).toBe(false);
-  });
-
-  test("Overrides reisen durch (required, sortable, filterable, default)", () => {
-    const f = createBigIntField({
-      required: true,
-      sortable: true,
-      filterable: true,
-      default: 42,
-    });
-    expect(f.required).toBe(true);
-    expect(f.sortable).toBe(true);
-    expect(f.filterable).toBe(true);
-    expect(f.default).toBe(42);
-  });
-});
-
-describe("buildEntityTable — bigInt-Mapping", () => {
-  test("bigInt-Spalte ist DISTINCT von number-Spalte (number=integer/32-bit, bigInt=bigint/64-bit)", () => {
-    const entity = createEntity({
-      fields: {
-        smallCount: createNumberField({}),
-        bigCount: createBigIntField({}),
-      },
-    });
-    const table = buildEntityTable("counters", entity);
-
-    const small = colByName(table, "small_count");
-    const big = colByName(table, "big_count");
-
-    // PgInteger vs PgBigint sind unterschiedliche columnType-Klassen in
-    // Drizzle — der genaue String ist Drizzle-Internal aber MUSS
-    // unterschiedlich sein, sonst geht der ganze 64-bit-Punkt verloren.
-    expect(small.columnType).not.toBe(big.columnType);
-  });
-
-  test("required bigInt wird NOT NULL", () => {
-    const entity = createEntity({
-      fields: {
-        requiredBig: createBigIntField({ required: true }),
-        optionalBig: createBigIntField({}),
-      },
-    });
-    const table = buildEntityTable("t", entity);
-    expect(colByName(table, "required_big").notNull).toBe(true);
-    expect(colByName(table, "optional_big").notNull).toBe(false);
-  });
-});
-
-describe("buildInsertSchema — bigInt-Validation", () => {
-  test("akzeptiert safe-integer-Werte inkl. >2^31", () => {
-    const entity = createEntity({
-      fields: { bytesWritten: createBigIntField({ required: true }) },
-    });
-    const schema = buildInsertSchema(entity);
-
-    // 2^31 = 2_147_483_648 — Klassisches integer-Overflow-Pattern.
-    expect(schema.parse({ bytesWritten: 2_147_483_648 })).toEqual({
-      bytesWritten: 2_147_483_648,
-    });
-    // 2^50 — weit ueber integer, klar in bigInt-Territorium.
-    expect(schema.parse({ bytesWritten: 2 ** 50 })).toEqual({
-      bytesWritten: 2 ** 50,
-    });
-  });
-
-  test("lehnt Float ab (silent-Truncation-Schutz)", () => {
-    const entity = createEntity({
-      fields: { count: createBigIntField({ required: true }) },
-    });
-    const schema = buildInsertSchema(entity);
-    expect(() => schema.parse({ count: 1.5 })).toThrow();
-  });
-
-  test("lehnt non-safe-integer ab (>2^53)", () => {
-    const entity = createEntity({
-      fields: { count: createBigIntField({ required: true }) },
-    });
-    const schema = buildInsertSchema(entity);
-    // 2^53 = 9_007_199_254_740_992 ist Number.MAX_SAFE_INTEGER.
-    // Werte ueber dem Cap koennen nicht round-trip-en ohne Praezisions-
-    // Verlust — Zod's .safe() greift hier.
-    expect(() => schema.parse({ count: Number.MAX_SAFE_INTEGER + 2 })).toThrow();
-  });
-
-  test("default-Wert reist in Zod-Schema durch", () => {
-    const entity = createEntity({
-      fields: { count: createBigIntField({ default: 100 }) },
-    });
-    const schema = buildInsertSchema(entity);
-    expect(schema.parse({})).toEqual({ count: 100 });
-  });
-});

package/src/db/__tests__/blind-index.integration.test.ts

@@ -1,280 +0,0 @@
-// Blind-Index end-to-end (#818): create/update schreiben die bidx-Spalte
-// (nie ins Event-Log), Equality-Lookups matchen über den OR-Rewrite sowohl
-// verschlüsselte als auch Klartext-Alt-Rows, Rebuild recomputet bidx aus
-// dem Ciphertext (erased → NULL), und der Forget-Sweep nullt sofort.
-
-import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import {
-  resetBlindIndexKeyForTests,
-  resetPiiSubjectKmsForTests,
-} from "@cosmicdrift/kumiko-framework/testing";
-import {
-  computeBlindIndex,
-  configureBlindIndexKey,
-  configurePiiSubjectKms,
-  decodeBlindIndexKey,
-  InMemoryKmsAdapter,
-  isPiiCiphertext,
-  subjectIdToKey,
-} from "../../crypto";
-import { defineFeature } from "../../engine/define-feature";
-import { createEntity, createTextField } from "../../engine/factories";
-import { createRegistry } from "../../engine/registry";
-import { rebuildProjection } from "../../pipeline";
-import { createProjectionStateTable } from "../../pipeline/projection-state";
-import { createTestDb, type TestDb, TestUsers, unsafeCreateEntityTable } from "../../stack";
-import { nullBlindIndexesForSubject } from "../blind-index-cleanup";
-import { createEventStoreExecutor } from "../event-store-executor";
-import { asRawClient, fetchOne } from "../query";
-import { buildEntityTable } from "../table-builder";
-import { createTenantDb, type TenantDb } from "../tenant-db";
-
-const TEST_KEY_B64 = Buffer.alloc(32, 7).toString("base64");
-const TEST_KEY = decodeBlindIndexKey(TEST_KEY_B64);
-
-const personEntity = createEntity({
-  table: "read_bidx_persons",
-  fields: {
-    email: createTextField({ required: true, personal: "self", find: "exact" }),
-    firstName: createTextField({ personal: false, reason: "test_fixture" }),
-  },
-});
-const personFeature = defineFeature("bidxtest", (r) => {
-  r.entity("person", personEntity);
-});
-const personTable = buildEntityTable("person", personEntity);
-
-// Lookupable entity whose read table is deliberately never created — used to
-// prove the forget sweep skips missing relations (fw#2550).
-const ghostEntity = createEntity({
-  table: "read_bidx_ghosts_missing",
-  fields: {
-    email: createTextField({ required: true, personal: "self", find: "exact" }),
-  },
-});
-const ghostFeature = defineFeature("bidxghost", (r) => {
-  r.entity("ghost", ghostEntity);
-});
-
-let testDb: TestDb;
-let tdb: TenantDb;
-let kms: InMemoryKmsAdapter;
-const adminUser = TestUsers.admin;
-
-beforeAll(async () => {
-  testDb = await createTestDb();
-  await unsafeCreateEntityTable(testDb.db, personEntity, "person");
-  await createProjectionStateTable(testDb.db);
-  tdb = createTenantDb(testDb.db, adminUser.tenantId);
-});
-
-afterAll(async () => {
-  await testDb.cleanup();
-});
-
-beforeEach(async () => {
-  await asRawClient(testDb.db).unsafe(
-    `TRUNCATE kumiko_events, read_bidx_persons, kumiko_projections RESTART IDENTITY CASCADE`,
-  );
-  kms = new InMemoryKmsAdapter();
-  configurePiiSubjectKms(kms);
-  configureBlindIndexKey(TEST_KEY_B64);
-});
-
-afterEach(() => {
-  resetPiiSubjectKmsForTests();
-  resetBlindIndexKeyForTests();
-});
-
-const crud = createEventStoreExecutor(personTable, personEntity, { entityName: "person" });
-
-async function rawRow(id: string): Promise<Record<string, unknown>> {
-  const rows = await asRawClient(testDb.db).unsafe<Record<string, unknown>>(
-    `SELECT * FROM read_bidx_persons WHERE id = $1`,
-    [id],
-  );
-  const row = rows[0];
-  if (!row) throw new Error(`no row for ${id}`);
-  return row;
-}
-
-describe("blind-index write path", () => {
-  test("create: bidx in the row, ciphertext in the email column, NOTHING in the event", async () => {
-    const created = await crud.create({ email: "marc@example.com" }, adminUser, tdb);
-    if (!created.isSuccess) throw new Error("create failed");
-
-    const row = await rawRow(String(created.data.id));
-    expect(row["email_bidx"]).toBe(computeBlindIndex(TEST_KEY, "marc@example.com"));
-    expect(isPiiCiphertext(row["email"])).toBe(true);
-
-    // Executor-Response: plaintext email, kein bidx-Leak.
-    expect(created.data.data["email"]).toBe("marc@example.com");
-    expect("emailBidx" in created.data.data).toBe(false);
-
-    const events = await asRawClient(testDb.db).unsafe<{ payload: unknown }>(
-      `SELECT payload FROM kumiko_events WHERE aggregate_id = $1`,
-      [String(created.data.id)],
-    );
-    const payloadText = JSON.stringify(events.map((e) => e.payload));
-    expect(payloadText).not.toContain("bidx");
-  });
-
-  test("update recomputes bidx for the changed field", async () => {
-    const created = await crud.create({ email: "old@example.com" }, adminUser, tdb);
-    if (!created.isSuccess) throw new Error("create failed");
-    await crud.update(
-      { id: created.data.id, version: 1, changes: { email: "new@example.com" } },
-      adminUser,
-      tdb,
-    );
-    const row = await rawRow(String(created.data.id));
-    expect(row["email_bidx"]).toBe(computeBlindIndex(TEST_KEY, "new@example.com"));
-  });
-});
-
-describe("blind-index lookup (OR-rewrite)", () => {
-  test("fetchOne by plaintext email finds the encrypted row", async () => {
-    const created = await crud.create({ email: "marc@example.com" }, adminUser, tdb);
-    if (!created.isSuccess) throw new Error("create failed");
-
-    const hit = await fetchOne<Record<string, unknown>>(tdb, personTable, {
-      email: "marc@example.com",
-    });
-    expect(hit).toBeDefined();
-    expect(hit?.["id"]).toBe(created.data.id);
-    // Read-Strip: bidx nie am Caller.
-    expect(hit && "emailBidx" in hit).toBe(false);
-    expect(hit && "email_bidx" in hit).toBe(false);
-
-    expect(await fetchOne(tdb, personTable, { email: "other@example.com" })).toBeUndefined();
-  });
-
-  test("plaintext legacy row (written pre-rollout) still matches the same query", async () => {
-    // Rollout-Zustand VOR KMS+Key: Klartext-Row, bidx NULL.
-    resetPiiSubjectKmsForTests();
-    resetBlindIndexKeyForTests();
-    const legacy = await crud.create({ email: "legacy@example.com" }, adminUser, tdb);
-    if (!legacy.isSuccess) throw new Error("create failed");
-    const legacyRow = await rawRow(String(legacy.data.id));
-    expect(legacyRow["email"]).toBe("legacy@example.com");
-    expect(legacyRow["email_bidx"]).toBeNull();
-
-    // Rollout an: dieselbe Query matcht über den Plaintext-Arm.
-    configurePiiSubjectKms(kms);
-    configureBlindIndexKey(TEST_KEY_B64);
-    const hit = await fetchOne<Record<string, unknown>>(tdb, personTable, {
-      email: "legacy@example.com",
-    });
-    expect(hit?.["id"]).toBe(legacy.data.id);
-  });
-
-  test("list filter eq matches the encrypted row and strips bidx", async () => {
-    const created = await crud.create(
-      { email: "marc@example.com", firstName: "Marc" },
-      adminUser,
-      tdb,
-    );
-    if (!created.isSuccess) throw new Error("create failed");
-
-    const page = await crud.list(
-      { filter: { field: "email", op: "eq", value: "marc@example.com" } },
-      adminUser,
-      tdb,
-    );
-    expect(page.rows).toHaveLength(1);
-    expect(page.rows[0]?.["email"]).toBe("marc@example.com");
-    expect(page.rows[0] && "emailBidx" in page.rows[0]).toBe(false);
-
-    const miss = await crud.list(
-      { filter: { field: "email", op: "eq", value: "nobody@example.com" } },
-      adminUser,
-      tdb,
-    );
-    expect(miss.rows).toHaveLength(0);
-  });
-});
-
-describe("blind-index rebuild + forget", () => {
-  const implicitName = "bidxtest:projection:person-entity";
-
-  test("rebuild recomputes bidx from ciphertext (identical to live)", async () => {
-    const created = await crud.create({ email: "marc@example.com" }, adminUser, tdb);
-    if (!created.isSuccess) throw new Error("create failed");
-    const liveBidx = (await rawRow(String(created.data.id)))["email_bidx"];
-
-    const registry = createRegistry([personFeature]);
-    expect(registry.getAllProjections().has(implicitName)).toBe(true);
-    await rebuildProjection(implicitName, { db: testDb.db, registry });
-
-    const rebuilt = await rawRow(String(created.data.id));
-    expect(rebuilt["email_bidx"]).toBe(liveBidx);
-    expect(rebuilt["email_bidx"]).toBe(computeBlindIndex(TEST_KEY, "marc@example.com"));
-  });
-
-  test("erased subject → rebuild sets bidx NULL, lookup stops matching", async () => {
-    const created = await crud.create({ email: "marc@example.com" }, adminUser, tdb);
-    if (!created.isSuccess) throw new Error("create failed");
-
-    await kms.eraseKey({ kind: "user", userId: String(created.data.id) });
-
-    const registry = createRegistry([personFeature]);
-    await rebuildProjection(implicitName, { db: testDb.db, registry });
-
-    const rebuilt = await rawRow(String(created.data.id));
-    expect(rebuilt["email_bidx"]).toBeNull();
-    expect(await fetchOne(tdb, personTable, { email: "marc@example.com" })).toBeUndefined();
-  });
-
-  test("erased subject → column drift excludes bidx (#916, not counted)", async () => {
-    // Pre-swap, live still holds the OLD bidx hash while the shadow already
-    // computed NULL for the erased subject — a real live-vs-shadow divergence,
-    // but the exact legitimate class countColumnDrift is designed to ignore.
-    const created = await crud.create({ email: "marc@example.com" }, adminUser, tdb);
-    if (!created.isSuccess) throw new Error("create failed");
-
-    await kms.eraseKey({ kind: "user", userId: String(created.data.id) });
-
-    const registry = createRegistry([personFeature]);
-    const result = await rebuildProjection(implicitName, { db: testDb.db, registry });
-
-    expect(result.columnDriftCount).toBe(0);
-    expect((await rawRow(String(created.data.id)))["email_bidx"]).toBeNull();
-  });
-
-  test("nullBlindIndexesForSubject nulls bidx immediately (no rebuild needed)", async () => {
-    const created = await crud.create({ email: "marc@example.com" }, adminUser, tdb);
-    if (!created.isSuccess) throw new Error("create failed");
-    expect((await rawRow(String(created.data.id)))["email_bidx"]).not.toBeNull();
-
-    await kms.eraseKey({ kind: "user", userId: String(created.data.id) });
-    const registry = createRegistry([personFeature]);
-    await nullBlindIndexesForSubject(
-      testDb.db,
-      registry.features,
-      subjectIdToKey({ kind: "user", userId: String(created.data.id) }),
-    );
-
-    expect((await rawRow(String(created.data.id)))["email_bidx"]).toBeNull();
-    expect(await fetchOne(tdb, personTable, { email: "marc@example.com" })).toBeUndefined();
-  });
-
-  test("nullBlindIndexesForSubject skips missing projection tables (fw#2550)", async () => {
-    const created = await crud.create({ email: "marc@example.com" }, adminUser, tdb);
-    if (!created.isSuccess) throw new Error("create failed");
-    expect((await rawRow(String(created.data.id)))["email_bidx"]).not.toBeNull();
-
-    await kms.eraseKey({ kind: "user", userId: String(created.data.id) });
-    // Registry includes a lookupable ghost whose table was never migrated —
-    // pre-fix this UPDATE threw after eraseKey and left bidx linkable.
-    const registry = createRegistry([personFeature, ghostFeature]);
-    await expect(
-      nullBlindIndexesForSubject(
-        testDb.db,
-        registry.features,
-        subjectIdToKey({ kind: "user", userId: String(created.data.id) }),
-      ),
-    ).resolves.toBeUndefined();
-
-    expect((await rawRow(String(created.data.id)))["email_bidx"]).toBeNull();
-  });
-});

package/src/db/__tests__/build-filter-where.test.ts

@@ -1,50 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { buildFilterWhere } from "../event-store-executor-context";
-
-describe("buildFilterWhere", () => {
-  test("eq: returns a direct field-equality WhereObject", () => {
-    expect(buildFilterWhere("status", "eq", "active")).toEqual({ status: "active" });
-  });
-
-  test("ne: wraps the value in a { ne } clause", () => {
-    expect(buildFilterWhere("status", "ne", "active")).toEqual({ status: { ne: "active" } });
-  });
-
-  test("eq with null: returns a direct null WhereObject (IS NULL downstream)", () => {
-    expect(buildFilterWhere("status", "eq", null)).toEqual({ status: null });
-  });
-
-  test("ne with null: wraps null in a { ne } clause (IS NOT NULL downstream, #2015)", () => {
-    expect(buildFilterWhere("status", "ne", null)).toEqual({ status: { ne: null } });
-  });
-
-  test("lt: wraps the value in a { lt } clause", () => {
-    expect(buildFilterWhere("createdAt", "lt", 100)).toEqual({ createdAt: { lt: 100 } });
-  });
-
-  test("gt: wraps the value in a { gt } clause", () => {
-    expect(buildFilterWhere("createdAt", "gt", 100)).toEqual({ createdAt: { gt: 100 } });
-  });
-
-  test("lte: wraps the value in a { lte } clause", () => {
-    expect(buildFilterWhere("createdAt", "lte", 100)).toEqual({ createdAt: { lte: 100 } });
-  });
-
-  test("gte: wraps the value in a { gte } clause", () => {
-    expect(buildFilterWhere("createdAt", "gte", 100)).toEqual({ createdAt: { gte: 100 } });
-  });
-
-  test("in: non-empty array → direct array WhereObject", () => {
-    expect(buildFilterWhere("status", "in", ["active", "pending"])).toEqual({
-      status: ["active", "pending"],
-    });
-  });
-
-  test("in: empty array → null (no-match short-circuit)", () => {
-    expect(buildFilterWhere("status", "in", [])).toBeNull();
-  });
-
-  test("in: non-array value → null (no-match short-circuit)", () => {
-    expect(buildFilterWhere("status", "in", "not-an-array")).toBeNull();
-  });
-});