@cosmicdrift/kumiko-bundled-features 0.16.0 → 0.18.0

package/src/user-data-rights/__tests__/{export-job-idempotency.integration.ts → export-job-idempotency.integration.test.ts}

@@ -16,14 +16,17 @@ import {
   selectMany,
   updateMany,
 } from "@cosmicdrift/kumiko-framework/bun-db";
+import { extractPgError } from "@cosmicdrift/kumiko-framework/db";
 import {
   setupTestStack,
   type TestStack,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createDataRetentionFeature } from "../../data-retention";
+import { createSessionsFeature } from "../../sessions";
 import { createUserFeature } from "../../user";
 import { createUserDataRightsFeature } from "../feature";
 import {
@@ -45,6 +48,8 @@ beforeAll(async () => {
       createUserFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      createSessionsFeature(),
+
       createUserDataRightsFeature(),
     ],
   });
@@ -57,18 +62,15 @@ afterAll(async () => {
 });
 
 beforeEach(async () => {
-  await asRawClient(stack.db).unsafe(`DELETE FROM "${exportJobsTable.tableName}"`);
+  await resetTestTables(stack.db, [exportJobsTable]);
 });
 
 const NOW = () => getTemporal().Now.instant();
 
-// Drizzle wraps PostgresError mit "Failed query: ..."; die original
-// PG-Message ist im `cause`. Unique-Violation hat sqlstate 23505.
-//
-// Constraint-Name pinnen damit der Test nur unsere Idempotency-
-// Constraint pinst, nicht zufaellig eine andere unique-violation
-// (z.B. UUID-Kollision auf id-PK durch wiederholtes Test-Setup) —
-// silent-Pass durch fremden Constraint waere falsche Bestaetigung.
+// postgres-js wirft PostgresError direkt; Drizzle wrappt in .cause.
+// extractPgError normalisiert beide Shapes. Constraint-Name pinnen damit
+// der Test nur unsere Idempotency-Constraint pinst, nicht zufaellig eine
+// andere unique-violation (z.B. UUID-Kollision auf id-PK).
 async function expectUniqueViolation(
   promise: Promise<unknown>,
   expectedConstraint: string,
@@ -80,9 +82,9 @@ async function expectUniqueViolation(
     caught = e;
   }
   expect(caught).toBeDefined();
-  const cause = (caught as { cause?: { code?: string; constraint_name?: string } }).cause;
-  expect(cause?.code).toBe("23505");
-  expect(cause?.constraint_name).toBe(expectedConstraint);
+  const pg = extractPgError(caught);
+  expect(pg?.code).toBe("23505");
+  expect(pg?.constraint_name).toBe(expectedConstraint);
 }
 
 // Re-Export aus dem Schema — Single source of truth, Rename hier

package/src/user-data-rights/__tests__/{request-cancel-deletion.integration.ts → request-cancel-deletion.integration.test.ts}

@@ -10,8 +10,8 @@
 // hier; der Frist-Ablauf-Cleanup folgt mit S2.U5b.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { asRawClient, insertOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import { insertOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
   setupTestStack,
@@ -20,12 +20,15 @@ import {
   testUserId,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import {
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,
+  tenantComplianceProfileTable,
 } from "../../compliance-profiles";
 import { createDataRetentionFeature } from "../../data-retention";
+import { createSessionsFeature } from "../../sessions";
 import { USER_STATUS, userEntity, userTable } from "../../user";
 import { createUserFeature } from "../../user/feature";
 import { createUserDataRightsFeature } from "../feature";
@@ -54,6 +57,8 @@ const features = [
   createUserFeature(),
   createDataRetentionFeature(),
   createComplianceProfilesFeature(),
+  createSessionsFeature(),
+
   createUserDataRightsFeature(),
 ];
 
@@ -69,11 +74,7 @@ afterAll(async () => {
 });
 
 beforeEach(async () => {
-  // Hard-clean User-Rows fuer einen sauberen Start je Test. softDelete
-  // wuerde sonst row-state aus voherigen Tests einschleppen.
-  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
-  await asRawClient(stack.db).unsafe(`DELETE FROM read_tenant_compliance_profiles`);
-  await asRawClient(stack.db).unsafe(`DELETE FROM kumiko_events`);
+  await resetTestTables(stack.db, [userTable, tenantComplianceProfileTable, eventsTable]);
 });
 
 // gracePeriodEnd ist `instant()` (Temporal.Instant in JS). Nicht JS-Date —

package/src/user-data-rights/__tests__/{request-deletion-callback.integration.ts → request-deletion-callback.integration.test.ts}

@@ -8,8 +8,8 @@
 // Properties — dieser Test verifiziert sie end-to-end.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { asRawClient, insertOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import { insertOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
   setupTestStack,
@@ -17,11 +17,14 @@ import {
   testTenantId,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
 import {
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,
+  tenantComplianceProfileTable,
 } from "../../compliance-profiles";
 import { createDataRetentionFeature } from "../../data-retention";
+import { createSessionsFeature } from "../../sessions";
 import { USER_STATUS, userEntity, userTable } from "../../user";
 import { createUserFeature } from "../../user/feature";
 import { createUserDataRightsFeature } from "../feature";
@@ -61,6 +64,8 @@ beforeAll(async () => {
       createUserFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      createSessionsFeature(),
+
       createUserDataRightsFeature({ sendDeletionRequestedEmail }),
     ],
   });
@@ -76,9 +81,7 @@ afterAll(async () => {
 beforeEach(async () => {
   state.calls = [];
   state.shouldThrow = false;
-  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
-  await asRawClient(stack.db).unsafe(`DELETE FROM read_tenant_compliance_profiles`);
-  await asRawClient(stack.db).unsafe(`DELETE FROM kumiko_events`);
+  await resetTestTables(stack.db, [userTable, tenantComplianceProfileTable, eventsTable]);
 });
 
 async function seedAlice(email: string = "alice@example.com"): Promise<void> {

package/src/user-data-rights/__tests__/{request-export.integration.ts → request-export.integration.test.ts}

@@ -24,7 +24,7 @@ import {
   selectMany,
   updateMany,
 } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
   setupTestStack,
@@ -32,9 +32,11 @@ import {
   testTenantId,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createDataRetentionFeature } from "../../data-retention";
+import { createSessionsFeature } from "../../sessions";
 import { createUserFeature } from "../../user";
 import { createUserDataRightsFeature } from "../feature";
 import { EXPORT_JOB_STATUS, exportJobEntity, exportJobsTable } from "../schema/export-job";
@@ -56,6 +58,8 @@ beforeAll(async () => {
       createUserFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      createSessionsFeature(),
+
       createUserDataRightsFeature(),
     ],
   });
@@ -68,8 +72,7 @@ afterAll(async () => {
 });
 
 beforeEach(async () => {
-  await asRawClient(stack.db).unsafe(`DELETE FROM "${exportJobsTable.tableName}"`);
-  await asRawClient(stack.db).unsafe(`DELETE FROM kumiko_events`);
+  await resetTestTables(stack.db, [exportJobsTable, eventsTable]);
 });
 
 type RequestExportResponse = {

package/src/user-data-rights/__tests__/{restriction-flow.integration.ts → restriction-flow.integration.test.ts}

@@ -12,10 +12,10 @@
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import { asRawClient, selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   setupTestStack,
   type TestStack,
@@ -24,13 +24,14 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { createLateBoundHolder } from "@cosmicdrift/kumiko-framework/testing";
+import { createLateBoundHolder, resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
 import { AuthErrors, AuthHandlers } from "../../auth-email-password/constants";
 import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
 import { hashPassword } from "../../auth-email-password/password-hashing";
 import {
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,
+  tenantComplianceProfileTable,
 } from "../../compliance-profiles";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
@@ -97,11 +98,13 @@ afterAll(async () => {
 });
 
 beforeEach(async () => {
-  await asRawClient(stack.db).unsafe(`DELETE FROM "${userSessionTable.tableName}"`);
-  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
-  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
-  await asRawClient(stack.db).unsafe(`DELETE FROM read_tenant_compliance_profiles`);
-  await asRawClient(stack.db).unsafe(`DELETE FROM kumiko_events`);
+  await resetTestTables(stack.db, [
+    userSessionTable,
+    userTable,
+    tenantMembershipsTable,
+    tenantComplianceProfileTable,
+    eventsTable,
+  ]);
 });
 
 async function seedAliceWithMembership(

package/src/user-data-rights/__tests__/{run-export-jobs.integration.ts → run-export-jobs.integration.test.ts}

@@ -23,7 +23,7 @@ import {
   selectMany,
   updateMany,
 } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createInMemoryFileProvider,
   type FileStorageProvider,
@@ -35,12 +35,16 @@ import {
   testTenantId,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import {
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,
+  tenantComplianceProfileTable,
 } from "../../compliance-profiles";
 import { createDataRetentionFeature } from "../../data-retention";
+import { createSessionsFeature } from "../../sessions";
+import { tenantMembershipsTable } from "../../tenant";
 import { createUserFeature, USER_STATUS, userEntity, userTable } from "../../user";
 import { createUserDataRightsFeature } from "../feature";
 import { runExportJobs } from "../run-export-jobs";
@@ -60,6 +64,8 @@ beforeAll(async () => {
       createUserFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      createSessionsFeature(),
+
       createUserDataRightsFeature(),
     ],
   });
@@ -94,12 +100,14 @@ afterAll(async () => {
 });
 
 beforeEach(async () => {
-  await asRawClient(stack.db).unsafe(`DELETE FROM "${exportDownloadTokensTable.tableName}"`);
-  await asRawClient(stack.db).unsafe(`DELETE FROM "${exportJobsTable.tableName}"`);
-  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
-  await asRawClient(stack.db).unsafe(`DELETE FROM kumiko_events`);
-  await asRawClient(stack.db).unsafe(`DELETE FROM read_tenant_compliance_profiles`);
-  await asRawClient(stack.db).unsafe(`DELETE FROM read_tenant_memberships`);
+  await resetTestTables(stack.db, [
+    exportDownloadTokensTable,
+    exportJobsTable,
+    userTable,
+    eventsTable,
+    tenantComplianceProfileTable,
+    tenantMembershipsTable,
+  ]);
   providerPerTenant = new Map();
 
   // Atom 5: aliceUser-Row mit email seeden — Worker-Notification-Callback
@@ -734,6 +742,8 @@ describe("runExportJobs :: Atom 3c file-binaries", () => {
         createUserFeature(),
         createDataRetentionFeature(),
         createComplianceProfilesFeature(),
+        createSessionsFeature(),
+
         createUserDataRightsFeature(),
         testFileExporter,
       ],
@@ -767,11 +777,13 @@ describe("runExportJobs :: Atom 3c file-binaries", () => {
 
   beforeEach(async () => {
     if (!localStack) return;
-    await asRawClient(localStack.db).unsafe(`DELETE FROM "${exportDownloadTokensTable.tableName}"`);
-    await asRawClient(localStack.db).unsafe(`DELETE FROM "${exportJobsTable.tableName}"`);
-    await asRawClient(localStack.db).unsafe(`DELETE FROM kumiko_events`);
-    await asRawClient(localStack.db).unsafe(`DELETE FROM read_tenant_compliance_profiles`);
-    await asRawClient(localStack.db).unsafe(`DELETE FROM read_tenant_memberships`);
+    await resetTestTables(localStack.db, [
+      exportDownloadTokensTable,
+      exportJobsTable,
+      eventsTable,
+      tenantComplianceProfileTable,
+      tenantMembershipsTable,
+    ]);
     // Reset zu safe Default damit kein Test den State an den naechsten leakt.
     currentTestFileName = "report.pdf";
   });
@@ -1033,7 +1045,7 @@ describe("runExportJobs :: Atom 5 notification-callbacks", () => {
   test("user ohne email → Callback skipped + console.warn (kein Throw)", async () => {
     // User-Row mit email=null seeden (override). Worker logged warn,
     // Callback wird NICHT gerufen, Worker-Run bleibt successful.
-    await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
+    await resetTestTables(stack.db, [userTable]);
     await insertOne(stack.db, userTable, {
       id: String(aliceUser.id),
       tenantId: tenantA,

package/src/user-data-rights/__tests__/{run-forget-cleanup.integration.ts → run-forget-cleanup.integration.test.ts}

@@ -17,15 +17,18 @@
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { asRawClient, insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import {
   setupTestStack,
   type TestStack,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createDataRetentionFeature, tenantRetentionOverrideEntity } from "../../data-retention";
 import { createFilesFeature } from "../../files";
+import { createSessionsFeature } from "../../sessions";
 import {
   createUserFeature,
   USER_ANONYMIZED_DISPLAY_NAME,
@@ -61,6 +64,8 @@ beforeAll(async () => {
       createFilesFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      createSessionsFeature(),
+
       createUserDataRightsFeature(),
       createUserDataRightsDefaultsFeature(),
     ],
@@ -109,9 +114,7 @@ afterAll(async () => {
 });
 
 beforeEach(async () => {
-  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
-  await asRawClient(stack.db).unsafe(`DELETE FROM read_tenant_memberships`);
-  await asRawClient(stack.db).unsafe(`DELETE FROM file_refs`);
+  await resetTestTables(stack.db, [userTable, "read_tenant_memberships", fileRefsTable]);
 });
 
 type Instant = InstanceType<ReturnType<typeof getTemporal>["Instant"]>;

package/src/user-data-rights/__tests__/{run-user-export.integration.ts → run-user-export.integration.test.ts}

@@ -16,15 +16,18 @@
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { asRawClient, insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import {
   setupTestStack,
   type TestStack,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createDataRetentionFeature } from "../../data-retention";
 import { createFilesFeature } from "../../files";
+import { createSessionsFeature } from "../../sessions";
 import { createUserFeature, USER_STATUS, userEntity, userTable } from "../../user";
 import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults";
 import { createUserDataRightsFeature } from "../feature";
@@ -51,6 +54,8 @@ beforeAll(async () => {
       createFilesFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      createSessionsFeature(),
+
       createUserDataRightsFeature(),
       createUserDataRightsDefaultsFeature(),
     ],
@@ -96,9 +101,7 @@ afterAll(async () => {
 });
 
 beforeEach(async () => {
-  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
-  await asRawClient(stack.db).unsafe(`DELETE FROM read_tenant_memberships`);
-  await asRawClient(stack.db).unsafe(`DELETE FROM file_refs`);
+  await resetTestTables(stack.db, [userTable, "read_tenant_memberships", fileRefsTable]);
 });
 
 const NOW = () => getTemporal().Now.instant();

package/src/user-data-rights/__tests__/{user-data-rights.integration.ts → user-data-rights.integration.test.ts}

@@ -10,6 +10,7 @@ import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { setupTestStack, type TestStack } from "@cosmicdrift/kumiko-framework/stack";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createDataRetentionFeature } from "../../data-retention";
+import { createSessionsFeature } from "../../sessions";
 import { createUserFeature } from "../../user";
 import { createUserDataRightsFeature } from "../feature";
 
@@ -18,11 +19,12 @@ let stack: TestStack;
 const userFeature = createUserFeature();
 const dataRetention = createDataRetentionFeature();
 const complianceProfiles = createComplianceProfilesFeature();
+const sessionsFeature = createSessionsFeature();
 const userDataRights = createUserDataRightsFeature();
 
 beforeAll(async () => {
   stack = await setupTestStack({
-    features: [userFeature, dataRetention, complianceProfiles, userDataRights],
+    features: [userFeature, sessionsFeature, dataRetention, complianceProfiles, userDataRights],
   });
 });
 

package/src/user-data-rights/db/queries/export-jobs.ts

@@ -1,6 +1,7 @@
-import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { exportJobsTable } from "../../schema/export-job";
 
 export type ExportJobCleanupCandidate = {
   readonly id: string;
@@ -16,8 +17,8 @@ export async function selectExportJobsForStorageCleanup(
   doneStatus: string,
   failedStatus: string,
 ): Promise<readonly ExportJobCleanupCandidate[]> {
-  return asRawClient(db).unsafe<ExportJobCleanupCandidate>(
-    `SELECT id, version, status, requested_from_tenant_id AS "requestedFromTenantId", download_storage_key AS "downloadStorageKey", expires_at AS "expiresAt" FROM read_export_jobs WHERE status IN ($1, $2) AND download_storage_key IS NOT NULL`,
-    [doneStatus, failedStatus],
-  );
+  return selectMany<ExportJobCleanupCandidate>(db, exportJobsTable, {
+    status: { in: [doneStatus, failedStatus] },
+    downloadStorageKey: { ne: null },
+  });
 }

package/src/user-data-rights/db/queries/forget-cleanup.ts

@@ -1,13 +1,18 @@
-import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { userTable } from "../../../user";
 
 export async function selectUsersDueForForgetCleanup(
   db: DbConnection,
   status: string,
-  gracePeriodEnd: string,
+  gracePeriodEndCutoff: Temporal.Instant | string,
 ): Promise<readonly { id: string }[]> {
-  return asRawClient(db).unsafe<{ id: string }>(
-    `SELECT id FROM read_users WHERE status = $1 AND grace_period_end <= $2`,
-    [status, gracePeriodEnd],
-  );
+  const cutoff =
+    typeof gracePeriodEndCutoff === "string"
+      ? Temporal.Instant.from(gracePeriodEndCutoff)
+      : gracePeriodEndCutoff;
+  return selectMany<{ id: string }>(db, userTable, {
+    status,
+    gracePeriodEnd: { lte: cutoff },
+  });
 }

package/src/user-data-rights/handlers/cancel-deletion.write.ts

@@ -23,7 +23,7 @@ export const cancelDeletionWrite = defineWriteHandler({
     // ctx.db.raw (kein TenantDb-Wrapper) weil User-Entity tenant-agnostisch
     // ist — siehe request-deletion.write.ts fuer die Begruendung. Cancel
     // muss aus jedem Tenant-Mode den User finden + zuruecksetzen koennen.
-    const row = await fetchOne<{ status: string; grace_period_end: Date | null }>(
+    const row = await fetchOne<{ status: string; gracePeriodEnd: Temporal.Instant | null }>(
       ctx.db.raw,
       userTable,
       { id: event.user.id },
@@ -37,26 +37,21 @@ export const cancelDeletionWrite = defineWriteHandler({
       );
     }
 
-    if (row["status"] !== USER_STATUS.DeletionRequested) {
+    if (row.status !== USER_STATUS.DeletionRequested) {
       return writeFailure(
         new UnprocessableError("no_pending_deletion", {
           details: {
             reason: "no_pending_deletion",
-            currentStatus: row["status"],
+            currentStatus: row.status,
           },
         }),
       );
     }
 
-    // inGrace computed JS-side: compare grace_period_end (Temporal.Instant
-    // from bun-db boundary) against current server clock.
-    const gracePeriodEnd = row["grace_period_end"];
+    const gracePeriodEnd = row.gracePeriodEnd;
     const inGrace =
       gracePeriodEnd != null &&
-      Temporal.Instant.compare(
-        gracePeriodEnd as unknown as Temporal.Instant,
-        Temporal.Now.instant(),
-      ) > 0;
+      Temporal.Instant.compare(gracePeriodEnd, Temporal.Now.instant()) > 0;
 
     if (!inGrace) {
       return writeFailure(

package/src/user-data-rights/handlers/export-status.query.ts

@@ -22,11 +22,11 @@ type Instant = InstanceType<ReturnType<typeof getTemporal>["Instant"]>;
 type ExportJobRow = {
   readonly id: string;
   readonly status: string;
-  readonly requested_at: Instant;
-  readonly completed_at: Instant | null;
-  readonly expires_at: Instant | null;
-  readonly error_message: string | null;
-  readonly bytes_written: number | null;
+  readonly requestedAt: Instant;
+  readonly completedAt: Instant | null;
+  readonly expiresAt: Instant | null;
+  readonly errorMessage: string | null;
+  readonly bytesWritten: number | null;
 };
 
 export const exportStatusQuery = defineQueryHandler({
@@ -49,13 +49,13 @@ export const exportStatusQuery = defineQueryHandler({
     return {
       hasJob: true as const,
       job: {
-        id: latest["id"],
-        status: latest["status"],
-        requestedAt: latest["requested_at"].toString(),
-        completedAt: latest["completed_at"]?.toString() ?? null,
-        expiresAt: latest["expires_at"]?.toString() ?? null,
-        errorMessage: latest["error_message"],
-        bytesWritten: latest["bytes_written"],
+        id: latest.id,
+        status: latest.status,
+        requestedAt: latest.requestedAt.toString(),
+        completedAt: latest.completedAt?.toString() ?? null,
+        expiresAt: latest.expiresAt?.toString() ?? null,
+        errorMessage: latest.errorMessage,
+        bytesWritten: latest.bytesWritten,
       },
     };
   },

package/src/user-data-rights/run-export-jobs.ts

@@ -595,11 +595,8 @@ async function storageCleanupPass(args: {
   // → Trade-off zugunsten DSGVO entschieden. Wenn ein Operator forensik
   // braucht, muss er das vor dem Cleanup-Pass capturen (out-of-band).
   //
-  // **SQL-Filter:** WHERE-clause auf downloadStorageKey IS NOT NULL filtert
-  // bereits in der DB statt im Loop. Bei skalierender DB-Historie (10k+
-  // done-jobs nach 30 Tagen) reduziert das den Worker-Roundtrip drastisch.
-  //
-  // or() + isNotNull(): no bun-db helper covers this combination — raw SQL.
+  // **SQL-Filter:** status IN (done, failed) + downloadStorageKey IS NOT NULL
+  // via selectMany (db/queries/export-jobs.ts).
   const candidates = await selectExportJobsForStorageCleanup(
     db,
     EXPORT_JOB_STATUS.Done,

package/src/user-data-rights/run-forget-cleanup.ts

@@ -112,7 +112,6 @@ export async function runForgetCleanup(
   const { db, registry, now, sendDeletionExecutedEmail } = args;
 
   // Step 1: Find users with expired grace period.
-  // lte with Instant: no bun-db operator covers this — raw SQL.
   const dueUsers = await selectUsersDueForForgetCleanup(
     db,
     USER_STATUS.DeletionRequested,

package/src/user-data-rights-defaults/__tests__/{user-data-rights-defaults.integration.ts → user-data-rights-defaults.integration.test.ts}

@@ -20,6 +20,7 @@ import {
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createDataRetentionFeature } from "../../data-retention";
 import { createFilesFeature } from "../../files";
+import { createSessionsFeature } from "../../sessions";
 import {
   createUserFeature,
   USER_ANONYMIZED_DISPLAY_NAME,
@@ -39,6 +40,7 @@ const features = [
   createFilesFeature(),
   createDataRetentionFeature(),
   createComplianceProfilesFeature(),
+  createSessionsFeature(),
   createUserDataRightsFeature(),
   createUserDataRightsDefaultsFeature(),
 ];