@cosmicdrift/kumiko-bundled-features 0.13.0 → 0.15.0

package/src/user-data-rights/__tests__/audit-log.integration.ts

@@ -1,5 +1,7 @@
 // S2.U7 — my-audit-log + invalid-attempt-audit + list-download-attempts.
 
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { asRawClient, insertMany, insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -8,8 +10,6 @@ import {
   testTenantId,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { sql } from "drizzle-orm";
-import { afterAll, beforeAll, beforeEach, describe, expect, test } from "vitest";
 import {
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,
@@ -50,14 +50,14 @@ afterAll(async () => {
 });
 
 beforeEach(async () => {
-  await stack.db.delete(userTable);
-  await stack.db.execute(sql`DELETE FROM read_tenant_compliance_profiles`);
-  await stack.db.execute(sql`DELETE FROM read_download_attempts`);
-  await stack.db.execute(sql`DELETE FROM kumiko_events`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM read_tenant_compliance_profiles`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM read_download_attempts`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM kumiko_events`);
 });
 
 async function seedUser(u: typeof alice, email: string): Promise<void> {
-  await stack.db.insert(userTable).values({
+  await insertOne(stack.db, userTable, {
     id: u.id,
     tenantId: u.tenantId,
     email,
@@ -78,12 +78,24 @@ async function seedEvent(
   payload: object,
 ): Promise<void> {
   _eventVersion += 1;
-  await stack.db.execute(sql`
+  await asRawClient(stack.db).unsafe(
+    `
     INSERT INTO kumiko_events
     (tenant_id, aggregate_type, aggregate_id, version, type, payload, metadata, created_at, created_by)
-    VALUES (${tenantId}, ${"test-aggregate"}, ${"00000000-0000-4000-8000-00000000aaaa"},
-            ${_eventVersion}, ${type}, ${JSON.stringify(payload)}, ${"{}"}, now(), ${createdBy})
-  `);
+    VALUES ($1, $2, $3,
+            $4, $5, $6, $7, now(), $8)
+  `,
+    [
+      tenantId,
+      "test-aggregate",
+      "00000000-0000-4000-8000-00000000aaaa",
+      _eventVersion,
+      type,
+      JSON.stringify(payload),
+      "{}",
+      createdBy,
+    ],
+  );
 }
 
 describe("my-audit-log", () => {
@@ -161,7 +173,7 @@ describe("list-download-attempts (DPO operator-query)", () => {
     // Direct-INSERT in attempts (simuliert was die download-handler schreiben).
     const T = await import("@cosmicdrift/kumiko-framework/time");
     const now = T.getTemporal().Now.instant();
-    await stack.db.insert(downloadAttemptsTable).values([
+    await insertMany(stack.db, downloadAttemptsTable, [
       {
         id: "11111111-1111-4111-8111-111111111111",
         tenantId: tenantA,

package/src/user-data-rights/__tests__/cross-data-matrix.integration.ts

@@ -12,6 +12,8 @@
 //   - Other-User-Isolation: Bobs notes/files bleiben unangetastet bei
 //     Alices Forget; Bobs Daten landen NICHT in Alices Export-Bundle.
 
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { asRawClient, insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   defineFeature,
   EXT_USER_DATA,
@@ -24,8 +26,6 @@ import {
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
-import { sql } from "drizzle-orm";
-import { afterAll, beforeAll, beforeEach, describe, expect, test } from "vitest";
 import {
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,
@@ -59,11 +59,14 @@ const PAST = (): Instant => getTemporal().Instant.fromEpochMilliseconds(Date.now
 // Stellvertretend fuer App-spezifische Entities (Chat-Message, Blog-Post
 // etc.), die ueber EXT_USER_DATA sauber in die Pipeline integrieren.
 const exportNotes: UserDataExportHook = async (ctx) => {
-  const result = await ctx.db.execute(sql`
+  const result = await asRawClient(ctx.db).unsafe(
+    `
     SELECT id, title, body
     FROM test_notes
-    WHERE tenant_id = ${ctx.tenantId} AND author_id = ${ctx.userId}
-  `);
+    WHERE tenant_id = $1 AND author_id = $2
+  `,
+    [ctx.tenantId, ctx.userId],
+  );
   // biome-ignore lint/suspicious/noExplicitAny: drizzle execute typing
   const rows = ((result as any).rows ?? result) as Array<{
     id: string;
@@ -78,10 +81,13 @@ const exportNotes: UserDataExportHook = async (ctx) => {
 };
 
 const deleteNotes: UserDataDeleteHook = async (ctx, _strategy) => {
-  await ctx.db.execute(sql`
+  await asRawClient(ctx.db).unsafe(
+    `
     DELETE FROM test_notes
-    WHERE tenant_id = ${ctx.tenantId} AND author_id = ${ctx.userId}
-  `);
+    WHERE tenant_id = $1 AND author_id = $2
+  `,
+    [ctx.tenantId, ctx.userId],
+  );
 };
 
 const testNotesFeature = defineFeature("test-notes", (r) => {
@@ -107,7 +113,7 @@ beforeAll(async () => {
   await unsafeCreateEntityTable(stack.db, userEntity);
   await unsafeCreateEntityTable(stack.db, tenantRetentionOverrideEntity);
   await unsafeCreateEntityTable(stack.db, tenantComplianceProfileEntity);
-  await stack.db.execute(sql`
+  await asRawClient(stack.db).unsafe(`
     CREATE TABLE IF NOT EXISTS read_tenant_memberships (
       id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
       tenant_id UUID NOT NULL,
@@ -124,7 +130,7 @@ beforeAll(async () => {
       UNIQUE(user_id, tenant_id)
     )
   `);
-  await stack.db.execute(sql`
+  await asRawClient(stack.db).unsafe(`
     CREATE TABLE IF NOT EXISTS file_refs (
       id UUID PRIMARY KEY,
       tenant_id UUID NOT NULL,
@@ -139,7 +145,7 @@ beforeAll(async () => {
       inserted_by_id TEXT
     )
   `);
-  await stack.db.execute(sql`
+  await asRawClient(stack.db).unsafe(`
     CREATE TABLE IF NOT EXISTS test_notes (
       id UUID PRIMARY KEY,
       tenant_id UUID NOT NULL,
@@ -155,10 +161,10 @@ afterAll(async () => {
 });
 
 beforeEach(async () => {
-  await stack.db.delete(userTable);
-  await stack.db.execute(sql`DELETE FROM read_tenant_memberships`);
-  await stack.db.execute(sql`DELETE FROM file_refs`);
-  await stack.db.execute(sql`DELETE FROM test_notes`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM read_tenant_memberships`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM file_refs`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM test_notes`);
 });
 
 async function seedUser(
@@ -170,7 +176,7 @@ async function seedUser(
     displayName?: string;
   } = {},
 ): Promise<void> {
-  await stack.db.insert(userTable).values({
+  await insertOne(stack.db, userTable, {
     id,
     tenantId: TENANT_SYSTEM,
     email: overrides.email ?? `user-${id}@example.com`,
@@ -185,11 +191,14 @@ async function seedUser(
 }
 
 async function seedMembership(userId: string, tenantId: string): Promise<void> {
-  await stack.db.execute(sql`
+  await asRawClient(stack.db).unsafe(
+    `
     INSERT INTO read_tenant_memberships (tenant_id, user_id, roles)
-    VALUES (${tenantId}, ${userId}, '["Member"]')
+    VALUES ($1, $2, '["Member"]')
     ON CONFLICT (user_id, tenant_id) DO NOTHING
-  `);
+  `,
+    [tenantId, userId],
+  );
 }
 
 async function seedFileRef(
@@ -198,10 +207,13 @@ async function seedFileRef(
   userId: string,
   name: string,
 ): Promise<void> {
-  await stack.db.execute(sql`
+  await asRawClient(stack.db).unsafe(
+    `
     INSERT INTO file_refs (id, tenant_id, storage_key, file_name, mime_type, size, inserted_by_id)
-    VALUES (${id}, ${tenantId}, ${`storage/${id}`}, ${name}, 'application/pdf', 1024, ${userId})
-  `);
+    VALUES ($1, $2, $3, $4, 'application/pdf', 1024, $5)
+  `,
+    [id, tenantId, `storage/${id}`, name, userId],
+  );
 }
 
 async function seedNote(
@@ -210,16 +222,22 @@ async function seedNote(
   userId: string,
   title: string,
 ): Promise<void> {
-  await stack.db.execute(sql`
+  await asRawClient(stack.db).unsafe(
+    `
     INSERT INTO test_notes (id, tenant_id, author_id, title, body)
-    VALUES (${id}, ${tenantId}, ${userId}, ${title}, ${`body for ${title}`})
-  `);
+    VALUES ($1, $2, $3, $4, $5)
+  `,
+    [id, tenantId, userId, title, `body for ${title}`],
+  );
 }
 
 async function fetchNotes(tenantId: string, userId: string): Promise<unknown[]> {
-  const result = await stack.db.execute(sql`
-    SELECT id, title FROM test_notes WHERE tenant_id = ${tenantId} AND author_id = ${userId}
-  `);
+  const result = await asRawClient(stack.db).unsafe(
+    `
+    SELECT id, title FROM test_notes WHERE tenant_id = $1 AND author_id = $2
+  `,
+    [tenantId, userId],
+  );
   // biome-ignore lint/suspicious/noExplicitAny: drizzle execute typing
   return ((result as any).rows ?? result) as unknown[];
 }
@@ -319,24 +337,33 @@ describe("Cross-Data-Matrix :: Forget cleant 3 Provider-Features cross-tenant",
     expect(await fetchNotes(TENANT_B, ALICE_ID)).toHaveLength(0);
 
     // Alices fileRef in Tenant A weg
-    const aliceFiles = await stack.db.execute(sql`
-      SELECT id FROM file_refs WHERE tenant_id = ${TENANT_A} AND inserted_by_id = ${ALICE_ID}
-    `);
+    const aliceFiles = await asRawClient(stack.db).unsafe(
+      `
+      SELECT id FROM file_refs WHERE tenant_id = $1 AND inserted_by_id = $2
+    `,
+      [TENANT_A, ALICE_ID],
+    );
     // biome-ignore lint/suspicious/noExplicitAny: drizzle execute typing
     expect((((aliceFiles as any).rows ?? aliceFiles) as unknown[]).length).toBe(0);
 
     // Bobs notes + files unangetastet
     expect(await fetchNotes(TENANT_A, BOB_ID)).toHaveLength(1);
-    const bobFiles = await stack.db.execute(sql`
-      SELECT id FROM file_refs WHERE tenant_id = ${TENANT_A} AND inserted_by_id = ${BOB_ID}
-    `);
+    const bobFiles = await asRawClient(stack.db).unsafe(
+      `
+      SELECT id FROM file_refs WHERE tenant_id = $1 AND inserted_by_id = $2
+    `,
+      [TENANT_A, BOB_ID],
+    );
     // biome-ignore lint/suspicious/noExplicitAny: drizzle execute typing
     expect((((bobFiles as any).rows ?? bobFiles) as unknown[]).length).toBe(1);
 
     // Alice-User-Row anonymisiert (DSGVO-Kern: PII raus, Sentinel-Email).
-    const aliceRow = await stack.db.execute(sql`
-      SELECT email, status FROM read_users WHERE id = ${ALICE_ID}
-    `);
+    const aliceRow = await asRawClient(stack.db).unsafe(
+      `
+      SELECT email, status FROM read_users WHERE id = $1
+    `,
+      [ALICE_ID],
+    );
     // biome-ignore lint/suspicious/noExplicitAny: drizzle execute typing
     const aliceRows = ((aliceRow as any).rows ?? aliceRow) as Array<{
       email: string;

package/src/user-data-rights/__tests__/download.integration.ts

@@ -7,7 +7,9 @@
 // Plus Audit-Updates (useCount, lastUsedAt, IP, UA), TTL-checks,
 // cross-user-isolation, cross-tenant-same-user.
 
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
+import { asRawClient, selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
@@ -24,8 +26,6 @@ import {
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
-import { sql } from "drizzle-orm";
-import { afterAll, beforeAll, beforeEach, describe, expect, test } from "vitest";
 import {
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,
@@ -127,7 +127,7 @@ beforeAll(async () => {
   await unsafeCreateEntityTable(stack.db, tenantComplianceProfileEntity);
   await unsafePushTables(stack.db, { configValuesTable });
   await createEventsTable(stack.db);
-  await stack.db.execute(sql`
+  await asRawClient(stack.db).unsafe(`
     CREATE TABLE IF NOT EXISTS read_tenant_memberships (
       id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
       tenant_id UUID NOT NULL,
@@ -151,12 +151,12 @@ afterAll(async () => {
 });
 
 beforeEach(async () => {
-  await stack.db.delete(exportDownloadTokensTable);
-  await stack.db.delete(exportJobsTable);
-  await stack.db.execute(sql`DELETE FROM kumiko_events`);
-  await stack.db.execute(sql`DELETE FROM read_tenant_compliance_profiles`);
-  await stack.db.execute(sql`DELETE FROM read_tenant_memberships`);
-  await stack.db.execute(sql`DELETE FROM ${configValuesTable}`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${exportDownloadTokensTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${exportJobsTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM kumiko_events`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM read_tenant_compliance_profiles`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM read_tenant_memberships`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM $1`, [configValuesTable]);
   providerPerTenant = new Map();
 
   // Setup file-foundation provider="inmemory" pro Tenant.
@@ -242,10 +242,7 @@ describe("download-by-token :: happy path", () => {
     expect(result.expiresAt).toMatch(/^\d{4}-\d{2}-\d{2}T/);
 
     // Audit-Update: useCount=1, lastUsedAt set, IP+UA persistiert
-    const tokenRows = (await stack.db
-      .select()
-      .from(exportDownloadTokensTable)
-      .where(sql`job_id = ${jobId}`)) as Array<{
+    const tokenRows = (await selectMany(stack.db, exportDownloadTokensTable, { jobId })) as Array<{
       useCount: number;
       lastUsedAt: { toString(): string } | null;
       lastUsedFromIp: string | null;
@@ -271,10 +268,9 @@ describe("download-by-token :: happy path", () => {
       aliceUser,
     );
 
-    const [row] = (await stack.db
-      .select()
-      .from(exportDownloadTokensTable)
-      .where(sql`job_id = ${jobId}`)) as Array<{ useCount: number }>;
+    const [row] = (await selectMany(stack.db, exportDownloadTokensTable, { jobId })) as Array<{
+      useCount: number;
+    }>;
     expect(row?.useCount).toBe(2);
   });
 });
@@ -298,10 +294,7 @@ describe("download-by-token :: error paths", () => {
     const longAgo = getTemporal().Instant.fromEpochMilliseconds(
       Date.now() - 365 * 24 * 60 * 60 * 1000,
     );
-    await stack.db
-      .update(exportDownloadTokensTable)
-      .set({ expiresAt: longAgo })
-      .where(sql`job_id = ${jobId}`);
+    await updateMany(stack.db, exportDownloadTokensTable, { expiresAt: longAgo }, { jobId });
 
     const res = await stack.http.query(
       "user-data-rights:query:download-by-token",
@@ -315,7 +308,7 @@ describe("download-by-token :: error paths", () => {
 
   test("failed Job → 404 download.unavailable", async () => {
     const { jobId, plainToken } = await seedDoneJobWithToken();
-    await stack.db.update(exportJobsTable).set({ status: "failed" }).where(sql`id = ${jobId}`);
+    await updateMany(stack.db, exportJobsTable, { status: "failed" }, { id: jobId });
 
     const res = await stack.http.query(
       "user-data-rights:query:download-by-token",
@@ -329,10 +322,7 @@ describe("download-by-token :: error paths", () => {
 
   test("storage cleared → 404 download.expired", async () => {
     const { jobId, plainToken } = await seedDoneJobWithToken();
-    await stack.db
-      .update(exportJobsTable)
-      .set({ downloadStorageKey: null })
-      .where(sql`id = ${jobId}`);
+    await updateMany(stack.db, exportJobsTable, { downloadStorageKey: null }, { id: jobId });
 
     const res = await stack.http.query(
       "user-data-rights:query:download-by-token",
@@ -368,10 +358,9 @@ describe("download-by-token :: error paths", () => {
     expect(body.error.i18nKey).toBe("userDataRights.errors.download.signedUrlNotSupported");
 
     // Sanity: Job-Row ist immer noch done — Operator-Bug aendert nicht den Job-State
-    const [row] = (await stack.db
-      .select()
-      .from(exportJobsTable)
-      .where(sql`id = ${jobId}`)) as Array<{ status: string }>;
+    const [row] = (await selectMany(stack.db, exportJobsTable, { id: jobId })) as Array<{
+      status: string;
+    }>;
     expect(row?.status).toBe("done");
   });
 });
@@ -392,10 +381,7 @@ describe("download-by-job :: happy path", () => {
     expect(result.url).toMatch(/^memory:\/\//);
 
     // UI-Klick zaehlt auch als Use → audit-row updated
-    const [row] = (await stack.db
-      .select()
-      .from(exportDownloadTokensTable)
-      .where(sql`job_id = ${jobId}`)) as Array<{
+    const [row] = (await selectMany(stack.db, exportDownloadTokensTable, { jobId })) as Array<{
       useCount: number;
       lastUsedFromIp: string | null;
     }>;
@@ -407,7 +393,7 @@ describe("download-by-job :: happy path", () => {
     // Symmetrisch zum token-Test: gleicher Code-Pfad muss auch im job-
     // handler 404 + unavailable raus, nicht 500.
     const { jobId } = await seedDoneJobWithToken();
-    await stack.db.update(exportJobsTable).set({ status: "failed" }).where(sql`id = ${jobId}`);
+    await updateMany(stack.db, exportJobsTable, { status: "failed" }, { id: jobId });
 
     const res = await stack.http.query(
       "user-data-rights:query:download-by-job",
@@ -421,10 +407,7 @@ describe("download-by-job :: happy path", () => {
 
   test("storage cleared (downloadStorageKey null) → 404 download.expired (job-Pfad)", async () => {
     const { jobId } = await seedDoneJobWithToken();
-    await stack.db
-      .update(exportJobsTable)
-      .set({ downloadStorageKey: null })
-      .where(sql`id = ${jobId}`);
+    await updateMany(stack.db, exportJobsTable, { downloadStorageKey: null }, { id: jobId });
 
     const res = await stack.http.query(
       "user-data-rights:query:download-by-job",
@@ -488,10 +471,7 @@ describe("r.httpRoute :: /user-export/by-token (Magic-Link e2e)", () => {
       }),
     );
 
-    const [row] = (await stack.db
-      .select()
-      .from(exportDownloadTokensTable)
-      .where(sql`job_id = ${jobId}`)) as Array<{
+    const [row] = (await selectMany(stack.db, exportDownloadTokensTable, { jobId })) as Array<{
       useCount: number;
       lastUsedFromIp: string | null;
       lastUsedUserAgent: string | null;
@@ -549,11 +529,14 @@ describe("download-by-job :: cross-user + cross-tenant", () => {
       roles: ["Member"],
     });
     // Membership in Tenant B persisten damit auth-stack User akzeptiert
-    await stack.db.execute(sql`
+    await asRawClient(stack.db).unsafe(
+      `
       INSERT INTO read_tenant_memberships (tenant_id, user_id)
-      VALUES (${tenantB}, ${String(aliceUser.id)})
+      VALUES ($1, $2)
       ON CONFLICT (user_id, tenant_id) DO NOTHING
-    `);
+    `,
+      [tenantB, String(aliceUser.id)],
+    );
 
     const result = await stack.http.queryOk<{ url: string }>(
       "user-data-rights:query:download-by-job",

package/src/user-data-rights/__tests__/export-job-idempotency.integration.ts

@@ -9,14 +9,19 @@
 // in Atom 1a's pure unit-Test absichtlich ausgelassen wurde weil er
 // reale Postgres + Drizzle-customType-Codec-Path braucht.
 
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import {
+  asRawClient,
+  insertOne,
+  selectMany,
+  updateMany,
+} from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   setupTestStack,
   type TestStack,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
-import { eq, sql } from "drizzle-orm";
-import { afterAll, beforeAll, beforeEach, describe, expect, test } from "vitest";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createDataRetentionFeature } from "../../data-retention";
 import { createUserFeature } from "../../user";
@@ -52,7 +57,7 @@ afterAll(async () => {
 });
 
 beforeEach(async () => {
-  await stack.db.delete(exportJobsTable);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${exportJobsTable.tableName}"`);
 });
 
 const NOW = () => getTemporal().Now.instant();
@@ -101,7 +106,7 @@ async function insertJob(
   if (overrides.bytesWritten !== undefined) {
     values["bytesWritten"] = overrides.bytesWritten;
   }
-  await stack.db.insert(exportJobsTable).values(values);
+  await insertOne(stack.db, exportJobsTable, values);
   return id;
 }
 
@@ -114,7 +119,7 @@ describe("ExportJob :: Partial-UNIQUE-Index", () => {
       IDEMPOTENCY_CONSTRAINT,
     );
 
-    const rows = await stack.db.select().from(exportJobsTable);
+    const rows = await selectMany(stack.db, exportJobsTable);
     expect(rows).toHaveLength(1);
   });
 
@@ -128,7 +133,7 @@ describe("ExportJob :: Partial-UNIQUE-Index", () => {
       IDEMPOTENCY_CONSTRAINT,
     );
 
-    const rows = await stack.db.select().from(exportJobsTable);
+    const rows = await selectMany(stack.db, exportJobsTable);
     expect(rows).toHaveLength(1);
   });
 
@@ -136,7 +141,7 @@ describe("ExportJob :: Partial-UNIQUE-Index", () => {
     await insertJob(ALICE_ID, EXPORT_JOB_STATUS.Pending);
     await insertJob(BOB_ID, EXPORT_JOB_STATUS.Pending);
 
-    const rows = await stack.db.select().from(exportJobsTable);
+    const rows = await selectMany(stack.db, exportJobsTable);
     expect(rows).toHaveLength(2);
   });
 
@@ -147,7 +152,7 @@ describe("ExportJob :: Partial-UNIQUE-Index", () => {
     // erfolgreichem Download
     await insertJob(ALICE_ID, EXPORT_JOB_STATUS.Pending);
 
-    const rows = await stack.db.select().from(exportJobsTable);
+    const rows = await selectMany(stack.db, exportJobsTable);
     expect(rows).toHaveLength(2);
   });
 
@@ -155,7 +160,7 @@ describe("ExportJob :: Partial-UNIQUE-Index", () => {
     await insertJob(ALICE_ID, EXPORT_JOB_STATUS.Failed);
     await insertJob(ALICE_ID, EXPORT_JOB_STATUS.Pending);
 
-    const rows = await stack.db.select().from(exportJobsTable);
+    const rows = await selectMany(stack.db, exportJobsTable);
     expect(rows).toHaveLength(2);
   });
 
@@ -163,7 +168,7 @@ describe("ExportJob :: Partial-UNIQUE-Index", () => {
     await insertJob(ALICE_ID, EXPORT_JOB_STATUS.Done);
     await insertJob(ALICE_ID, EXPORT_JOB_STATUS.Done);
 
-    const rows = await stack.db.select().from(exportJobsTable);
+    const rows = await selectMany(stack.db, exportJobsTable);
     expect(rows).toHaveLength(2);
   });
 
@@ -171,10 +176,12 @@ describe("ExportJob :: Partial-UNIQUE-Index", () => {
     // Alice pending insert
     const aliceJobId = await insertJob(ALICE_ID, EXPORT_JOB_STATUS.Pending);
     // Worker pickt auf — Status flip
-    await stack.db
-      .update(exportJobsTable)
-      .set({ status: EXPORT_JOB_STATUS.Running })
-      .where(eq(exportJobsTable.id, aliceJobId));
+    await updateMany(
+      stack.db,
+      exportJobsTable,
+      { status: EXPORT_JOB_STATUS.Running },
+      { id: aliceJobId },
+    );
 
     // Zweiter pending-Insert fuer Alice → faellt weiter, weil bestehender
     // Job in running auch im Index-Filter ist.
@@ -184,13 +191,15 @@ describe("ExportJob :: Partial-UNIQUE-Index", () => {
     );
 
     // Aber wenn der running-Job fertig wird (done), darf User wieder pending starten
-    await stack.db
-      .update(exportJobsTable)
-      .set({ status: EXPORT_JOB_STATUS.Done })
-      .where(eq(exportJobsTable.id, aliceJobId));
+    await updateMany(
+      stack.db,
+      exportJobsTable,
+      { status: EXPORT_JOB_STATUS.Done },
+      { id: aliceJobId },
+    );
 
     await insertJob(ALICE_ID, EXPORT_JOB_STATUS.Pending);
-    const rows = await stack.db.select().from(exportJobsTable);
+    const rows = await selectMany(stack.db, exportJobsTable);
     expect(rows).toHaveLength(2);
   });
 });
@@ -202,10 +211,9 @@ describe("ExportJob :: bigInt bytesWritten DB-Roundtrip", () => {
       bytesWritten: TWO_GB_PLUS,
     });
 
-    const [row] = await stack.db
-      .select({ bytesWritten: exportJobsTable["bytesWritten"] })
-      .from(exportJobsTable)
-      .where(eq(exportJobsTable["id"], id));
+    const [row] = (await selectMany(stack.db, exportJobsTable, { id })) as Array<{
+      bytesWritten: number;
+    }>;
 
     expect(row?.bytesWritten).toBe(TWO_GB_PLUS);
   });
@@ -216,10 +224,9 @@ describe("ExportJob :: bigInt bytesWritten DB-Roundtrip", () => {
       bytesWritten: ONE_PB_PLUS,
     });
 
-    const [row] = await stack.db
-      .select({ bytesWritten: exportJobsTable["bytesWritten"] })
-      .from(exportJobsTable)
-      .where(eq(exportJobsTable["id"], id));
+    const [row] = (await selectMany(stack.db, exportJobsTable, { id })) as Array<{
+      bytesWritten: number;
+    }>;
 
     expect(row?.bytesWritten).toBe(ONE_PB_PLUS);
   });
@@ -232,7 +239,7 @@ describe("ExportJob :: bigInt bytesWritten DB-Roundtrip", () => {
     // Driver-Mapping — wenn jemand `case "bigInt"` zu `integer` zurueck-
     // refactored, faellt dieser Test um obwohl die JS-Werte sich
     // numerisch verhalten.
-    const result = await stack.db.execute(sql`
+    const result = await asRawClient(stack.db).unsafe(`
       SELECT data_type FROM information_schema.columns
       WHERE table_name = 'read_export_jobs' AND column_name = 'bytes_written'
     `);

package/src/user-data-rights/__tests__/export-job-schema.test.ts

@@ -13,8 +13,8 @@
 // Schema-Snapshot, kein Behavior-Test. Behavior-Tests kommen mit Atom 2
 // (request-export.write.ts) + Atom 3 (Worker).
 
+import { describe, expect, test } from "bun:test";
 import { COMPLIANCE_PROFILES } from "@cosmicdrift/kumiko-framework/compliance";
-import { describe, expect, test } from "vitest";
 import { EXPORT_JOB_STATUS, exportJobEntity } from "../schema/export-job";
 
 describe("EXPORT_JOB_STATUS Drift-Guard", () => {
@@ -32,7 +32,7 @@ describe("EXPORT_JOB_STATUS Drift-Guard", () => {
     // alphabetische Sortierung — die State-Machine kuemmert sich nicht
     // um Sort-Order, ein Re-Order der Konstanten waere kein Bug.
     for (const value of Object.values(EXPORT_JOB_STATUS)) {
-      expect(value).toBe(value.toLowerCase());
+      expect(value as string).toBe(value.toLowerCase());
       expect(value).toMatch(/^[a-z]+$/);
     }
   });

package/src/user-data-rights/__tests__/policy-to-strategy.test.ts

@@ -4,7 +4,7 @@
 // werden. Memory `feedback_no_fake_tests`: das Mapping IST die Logik,
 // nicht ein Detail.
 
-import { describe, expect, test } from "vitest";
+import { describe, expect, test } from "bun:test";
 import { policyToStrategy } from "../run-forget-cleanup";
 
 describe("policyToStrategy", () => {