@cosmicdrift/kumiko-framework 0.13.0 → 0.15.0

package/src/engine/types/step.ts

@@ -9,8 +9,8 @@
 // (see TS-typing notes in the design doc). M.1 uses unsafeAppendEvent
 // semantics under the hood for r.step.aggregate.appendEvent.
 
-import type { SQL, Table } from "drizzle-orm";
 import type { EventStoreExecutor } from "../../db/event-store-executor";
+import type { WhereObject } from "../../db/query";
 import type { KumikoEventTypeMap } from "./event-type-map";
 import type { HandlerContext, WriteEvent, WriteResult } from "./handlers";
 import type { SaveContext } from "./hooks";
@@ -200,31 +200,31 @@ export type StepNamespace = {
   // and NOT registered as an aggregate-table via r.entity. See
   // step-vocabulary.md "Was unsafeProjection.* überspringt".
   readonly unsafeProjectionUpsert: (args: {
-    readonly table: Table;
+    readonly table: unknown;
     readonly on: readonly string[];
     readonly row: StepResolver<Record<string, unknown>>;
   }) => StepInstance;
   // Sibling: delete row(s) from a read-side projection table. Same
   // boot-validation contract as unsafeProjectionUpsert.
   readonly unsafeProjectionDelete: (args: {
-    readonly table: Table;
-    readonly where: StepResolver<SQL>;
+    readonly table: unknown;
+    readonly where: StepResolver<WhereObject>;
   }) => StepInstance;
-  // Read sub-namespace — thin wrapper on ctx.db.select(). Caller-owned
-  // tenant-filter (does NOT auto-inject like ctx.queryProjection does).
+  // Read sub-namespace — thin wrapper on selectMany/fetchOne (bun-db).
+  // Caller-owned tenant-filter (does NOT auto-inject like ctx.queryProjection does).
   readonly read: {
     readonly findOne: (
       name: string,
       opts: {
-        readonly table: Table;
-        readonly where: StepResolver<SQL | undefined>;
+        readonly table: unknown;
+        readonly where: StepResolver<WhereObject | undefined>;
       },
     ) => StepInstance;
     readonly findMany: (
       name: string,
       opts: {
-        readonly table: Table;
-        readonly where?: StepResolver<SQL | undefined>;
+        readonly table: unknown;
+        readonly where?: StepResolver<WhereObject | undefined>;
         readonly limit?: number;
       },
     ) => StepInstance;

package/src/engine/validate-projection-allowlist.ts

@@ -23,7 +23,6 @@
 // caught by this validator. A future lint-rule will enforce the contract
 // statically; today it lives in this comment + the StepBuilder doc.
 
-import { getTableName, type Table } from "drizzle-orm";
 import { getStep } from "./define-step";
 import { buildPipelineSteps } from "./pipeline";
 import type { FeatureDefinition, SessionUser, TenantId, WriteEvent } from "./types";
@@ -56,7 +55,28 @@ function* walkAllSteps(steps: readonly StepInstance[]): Generator<StepInstance,
   }
 }
 
-type UnsafeProjectionStepArgs = { readonly table: Table };
+// @cast-boundary drizzle-bridge — reads table name from drizzle Symbol
+// without importing drizzle-orm (bun-db pattern, see bun-db/query.ts).
+const KUMIKO_NAME_SYMBOL = Symbol.for("kumiko:schema:Name");
+
+function resolveTableNameFromStep(table: unknown): string {
+  if (typeof table === "object" && table !== null) {
+    // EntityTableMeta discriminator
+    if (
+      "source" in table &&
+      "tableName" in table &&
+      typeof (table as Record<string, unknown>)["tableName"] === "string"
+    ) {
+      return (table as Record<string, unknown>)["tableName"] as string;
+    }
+    // drizzle pgTable
+    const name = (table as Record<symbol, unknown>)[KUMIKO_NAME_SYMBOL];
+    if (typeof name === "string") return name;
+  }
+  throw new Error(`validate-projection-allowlist: cannot resolve table name from ${String(table)}`);
+}
+
+type UnsafeProjectionStepArgs = { readonly table: unknown };
 
 const DUMMY_USER: SessionUser = {
   id: "00000000-0000-0000-0000-000000000000",
@@ -137,7 +157,7 @@ export function validateProjectionAllowlist(features: readonly FeatureDefinition
               `without a \`table\` argument.`,
           );
         }
-        const tableName = getTableName(stepArgs.table);
+        const tableName = resolveTableNameFromStep(stepArgs.table);
 
         const aggregateOwner = aggregateTables.get(tableName);
         if (aggregateOwner) {

package/src/entrypoint/__tests__/{entrypoint-job-wiring.integration.ts → entrypoint-job-wiring.integration.test.ts}

@@ -12,12 +12,13 @@
 // so a future refactor that drops the merge fails here instead of silently
 // regressing to the Welle-2.5 state.
 
-import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { z } from "zod";
+import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
 import { createRegistry, defineFeature } from "../../engine";
 import { createArchivedStreamsTable, createEventsTable } from "../../event-store";
 import { createEventConsumerStateTable } from "../../pipeline";
-import { createTestDb, createTestRedis, type TestDb, type TestRedis, TestUsers } from "../../stack";
+import { createTestRedis, type TestRedis, TestUsers } from "../../stack";
 import { waitFor } from "../../testing";
 import { createAllInOneEntrypoint } from "../index";
 
@@ -72,7 +73,7 @@ const mixedLaneFeature = defineFeature("mixed", (r) => {
 const JWT = "entrypoint-wiring-test-secret-must-be-32-chars!";
 const adminUser = TestUsers.admin;
 
-let testDb: TestDb;
+let testDb: BunTestDb;
 let testRedis: TestRedis;
 
 beforeAll(async () => {

package/src/entrypoint/__tests__/{split-deploy.integration.ts → split-deploy.integration.test.ts}

@@ -11,12 +11,13 @@
 //      guard — buildServer always wires an SSE consumer so this only
 //      fires with systemConsumers explicitly disabled).
 
-import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { z } from "zod";
+import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
 import { createRegistry, defineFeature } from "../../engine";
 import { createArchivedStreamsTable, createEventsTable } from "../../event-store";
 import { createEventConsumerStateTable } from "../../pipeline";
-import { createTestDb, createTestRedis, type TestDb, type TestRedis } from "../../stack";
+import { createTestRedis, type TestRedis } from "../../stack";
 import { createAllInOneEntrypoint, createApiEntrypoint, createWorkerEntrypoint } from "../index";
 
 const splitFeature = defineFeature("split", (r) => {
@@ -38,7 +39,7 @@ function uniquePrefix(label: string): string {
   return `${label}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
 }
 
-let testDb: TestDb;
+let testDb: BunTestDb;
 let testRedis: TestRedis;
 
 beforeAll(async () => {

package/src/env/__tests__/compose-env-schema.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, it } from "vitest";
+import { describe, expect, it } from "bun:test";
 import { z } from "zod";
 import { defineFeature } from "../../engine/define-feature";
 import { camelCase, composeEnvSchema, KumikoBootError, parseEnv, pulumiConfigKey } from "../index";

package/src/env/__tests__/dry-run.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, it } from "vitest";
+import { describe, expect, it } from "bun:test";
 import { z } from "zod";
 import { defineFeature } from "../../engine/define-feature";
 import { renderDryRun } from "../dry-run";

package/src/errors/__tests__/classes.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, test } from "vitest";
+import { describe, expect, test } from "bun:test";
 import { z } from "zod";
 import {
   AccessDeniedError,

package/src/errors/__tests__/write-failures.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, test } from "vitest";
+import { describe, expect, test } from "bun:test";
 import { failNotFound, failTransition, failUnprocessable } from "../write-error-info";
 
 describe("failNotFound", () => {

package/src/es-ops/__tests__/{context.integration.ts → context.integration.test.ts}

@@ -10,25 +10,27 @@
 // Feature in den Tests zu schwer wäre — wir testen nur den Read-Helper-
 // Layer, nicht die volle Event-Store-Pipeline.
 
+import { afterAll, beforeAll, beforeEach, describe, expect, mock, test } from "bun:test";
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { sql } from "drizzle-orm";
-import { afterAll, beforeAll, beforeEach, describe, expect, test, vi } from "vitest";
-import { createTestDb, type TestDb } from "../../stack";
+import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
+import { asRawClient, selectMany } from "../../db/query";
+import { ensureTemporalPolyfill } from "../../time/polyfill";
 import { createSeedMigrationContext } from "../context";
 import { createEsOperationsTable, esOperationsTable } from "../operations-schema";
 import { runPendingSeedMigrations } from "../runner";
 
-let testDb: TestDb;
+let testDb: BunTestDb;
 
 beforeAll(async () => {
+  await ensureTemporalPolyfill();
   testDb = await createTestDb();
   await createEsOperationsTable(testDb.db);
 
   // Minimal-Schema-Stubs für die 3 Read-Tabellen die context.ts liest.
   // Spalten matchen production (siehe Sysadmin-Stream-Tenant-Bug Memory).
-  await testDb.db.execute(sql`
+  await asRawClient(testDb.db).unsafe(`
     CREATE TABLE IF NOT EXISTS read_users (
       id          uuid PRIMARY KEY,
       email       text NOT NULL,
@@ -54,7 +56,7 @@ afterAll(async () => {
 });
 
 beforeEach(async () => {
-  await testDb.db.execute(sql`
+  await asRawClient(testDb.db).unsafe(`
     TRUNCATE kumiko_es_operations, kumiko_events, read_users, read_tenant_memberships, read_tenants
     RESTART IDENTITY CASCADE
   `);
@@ -70,26 +72,32 @@ async function insertMembershipWithEvent(args: {
   readonly streamTenantId: string;
   readonly roles: string;
 }): Promise<void> {
-  await testDb.db.execute(sql`
+  await asRawClient(testDb.db).unsafe(
+    `
     INSERT INTO read_tenant_memberships (id, user_id, tenant_id, roles)
-    VALUES (${args.id}::uuid, ${args.userId}, ${args.payloadTenantId}::uuid, ${args.roles})
-  `);
-  await testDb.db.execute(sql`
+    VALUES ($1::uuid, $2, $3::uuid, $4)
+  `,
+    [args.id, args.userId, args.payloadTenantId, args.roles],
+  );
+  await asRawClient(testDb.db).unsafe(
+    `
     INSERT INTO kumiko_events
       (aggregate_id, aggregate_type, tenant_id, version, type, payload, metadata, created_by)
     VALUES
-      (${args.id}::uuid, 'tenant-membership', ${args.streamTenantId}::uuid, 1,
+      ($1::uuid, 'tenant-membership', $2::uuid, 1,
        'tenant-membership.created', '{}'::jsonb, '{"userId":"system"}'::jsonb, 'system')
-  `);
+  `,
+    [args.id, args.streamTenantId],
+  );
 }
 
 function makeMockDispatcher() {
   return {
-    write: vi.fn(async () => ({ isSuccess: true as const, data: {} })),
-    query: vi.fn(),
-    command: vi.fn(),
-    batch: vi.fn(),
-    resolveAuthClaims: vi.fn(),
+    write: mock(async () => ({ isSuccess: true as const, data: {} })),
+    query: mock(),
+    command: mock(),
+    batch: mock(),
+    resolveAuthClaims: mock(),
   };
 }
 
@@ -105,10 +113,13 @@ describe("SeedMigrationContext.findUserByEmail (integration)", () => {
   test("liest existing user-row korrekt + maps tenant_id → tenantId", async () => {
     const userId = "01900000-0000-7000-8000-000000000001";
     const tenantId = "00000000-0000-4000-8000-000000000099";
-    await testDb.db.execute(sql`
+    await asRawClient(testDb.db).unsafe(
+      `
       INSERT INTO read_users (id, email, tenant_id)
-      VALUES (${userId}::uuid, 'admin@example.com', ${tenantId}::uuid)
-    `);
+      VALUES ($1::uuid, 'admin@example.com', $2::uuid)
+    `,
+      [userId, tenantId],
+    );
 
     const ctx = createSeedMigrationContext({
       dispatcher: makeMockDispatcher() as never,
@@ -231,11 +242,14 @@ describe("SeedMigrationContext.findMembershipsOfUser (integration)", () => {
     // statt einer mit fehlendem stream-tenant zu arbeiten und schwer
     // diagnostizierbare version_conflict-Errors zu produzieren.
     const userId = "01900000-0000-7000-8000-000000000003";
-    await testDb.db.execute(sql`
+    await asRawClient(testDb.db).unsafe(
+      `
       INSERT INTO read_tenant_memberships (id, user_id, tenant_id, roles) VALUES
-        ('00000000-0000-4000-8000-0000000000d1'::uuid, ${userId},
+        ('00000000-0000-4000-8000-0000000000d1'::uuid, $1,
          '00000000-0000-4000-8000-000000000005'::uuid, '["Admin"]')
-    `);
+    `,
+      [userId],
+    );
     const ctx = createSeedMigrationContext({
       dispatcher: makeMockDispatcher() as never,
       dbRunner: testDb.db,
@@ -247,7 +261,7 @@ describe("SeedMigrationContext.findMembershipsOfUser (integration)", () => {
 
 describe("SeedMigrationContext.findTenants (integration)", () => {
   test("returnt alle Tenants sortiert nach inserted_at", async () => {
-    await testDb.db.execute(sql`
+    await asRawClient(testDb.db).unsafe(`
       INSERT INTO read_tenants (id, name, tenant_key, inserted_at) VALUES
         ('00000000-0000-4000-8000-000000000002'::uuid, 'Beta',  'beta',  '2026-01-02'),
         ('00000000-0000-4000-8000-000000000001'::uuid, 'Alpha', 'alpha', '2026-01-01')
@@ -296,7 +310,7 @@ describe("runPendingSeedMigrations: skippable + env-flag (integration)", () => {
 
       // Kritisch: KEIN Marker — beim nächsten Boot ohne env-flag würde
       // der Seed dann tatsächlich laufen.
-      const markers = await testDb.db.select().from(esOperationsTable);
+      const markers = await selectMany(testDb.db, esOperationsTable);
       expect(markers).toHaveLength(0);
     } finally {
       delete process.env[envKey];
@@ -329,7 +343,7 @@ describe("runPendingSeedMigrations: skippable + env-flag (integration)", () => {
       expect(r.appliedIds).toEqual(["2026-05-20-skippable-but-no-flag"]);
       expect(r.skippedIds).toEqual([]);
 
-      const markers = await testDb.db.select().from(esOperationsTable);
+      const markers = await selectMany(testDb.db, esOperationsTable);
       expect(markers).toHaveLength(1);
     } finally {
       rmSync(dir, { recursive: true, force: true });
@@ -341,7 +355,7 @@ describe("runPendingSeedMigrations: skippable + env-flag (integration)", () => {
 
 describe("SeedMigrationContext.db (escape-hatch, integration)", () => {
   test("ctx.db kann für eigene Lookups genutzt werden (read-only)", async () => {
-    await testDb.db.execute(sql`
+    await asRawClient(testDb.db).unsafe(`
       INSERT INTO read_tenants (id, name, tenant_key) VALUES
         ('00000000-0000-4000-8000-000000000007'::uuid, 'Lucky', 'lucky')
     `);
@@ -349,8 +363,8 @@ describe("SeedMigrationContext.db (escape-hatch, integration)", () => {
       dispatcher: makeMockDispatcher() as never,
       dbRunner: testDb.db,
     });
-    const rows = (await ctx.db.execute(
-      sql`SELECT name FROM read_tenants WHERE tenant_key = 'lucky'`,
+    const rows = (await asRawClient(ctx.db).unsafe(
+      `SELECT name FROM read_tenants WHERE tenant_key = 'lucky'`,
     )) as unknown as readonly { name: string }[];
     expect(rows[0]?.name).toBe("Lucky");
   });

package/src/es-ops/__tests__/{runner.integration.ts → runner.integration.test.ts}

@@ -8,19 +8,21 @@
 // Heavy lifting (mock-dispatcher, in-memory-applied-set) liegt in
 // runner.test.ts. Hier nur DB-Round-Trip-Wahrheit.
 
+import { afterAll, beforeAll, beforeEach, describe, expect, mock, test } from "bun:test";
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { sql } from "drizzle-orm";
-import { afterAll, beforeAll, beforeEach, describe, expect, test, vi } from "vitest";
-import { createTestDb, type TestDb } from "../../stack";
+import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
+import { asRawClient, insertOne, selectMany } from "../../db/query";
+import { ensureTemporalPolyfill } from "../../time/polyfill";
 import { createSeedMigrationContext } from "../context";
 import { createEsOperationsTable, esOperationsTable } from "../operations-schema";
 import { runPendingSeedMigrations } from "../runner";
 
-let testDb: TestDb;
+let testDb: BunTestDb;
 
 beforeAll(async () => {
+  await ensureTemporalPolyfill();
   testDb = await createTestDb();
   await createEsOperationsTable(testDb.db);
 });
@@ -30,7 +32,7 @@ afterAll(async () => {
 });
 
 beforeEach(async () => {
-  await testDb.db.execute(sql`TRUNCATE kumiko_es_operations RESTART IDENTITY`);
+  await asRawClient(testDb.db).unsafe(`TRUNCATE kumiko_es_operations RESTART IDENTITY`);
 });
 
 function makeTempSeedsDir(files: readonly { name: string; content: string }[]): string {
@@ -42,14 +44,14 @@ function makeTempSeedsDir(files: readonly { name: string; content: string }[]):
 function makeMockDispatcher() {
   const calls: Array<{ qn: string; payload: unknown }> = [];
   return {
-    write: vi.fn(async (qn: string, payload: unknown) => {
+    write: mock(async (qn: string, payload: unknown) => {
       calls.push({ qn, payload });
       return { isSuccess: true as const, data: {} };
     }),
-    query: vi.fn(),
-    command: vi.fn(),
-    batch: vi.fn(),
-    resolveAuthClaims: vi.fn(),
+    query: mock(),
+    command: mock(),
+    batch: mock(),
+    resolveAuthClaims: mock(),
     calls,
   };
 }
@@ -82,7 +84,7 @@ describe("runPendingSeedMigrations (integration)", () => {
       expect(r1.appliedIds).toEqual(["2026-05-20-noop"]);
 
       // Marker landed
-      const markers1 = await testDb.db.select().from(esOperationsTable);
+      const markers1 = await selectMany(testDb.db, esOperationsTable);
       expect(markers1).toHaveLength(1);
       expect(markers1[0]?.id).toBe("2026-05-20-noop");
       expect(markers1[0]?.operationType).toBe("seed-migration");
@@ -98,7 +100,7 @@ describe("runPendingSeedMigrations (integration)", () => {
         logger: () => {},
       });
       expect(r2.appliedIds).toEqual([]);
-      const markers2 = await testDb.db.select().from(esOperationsTable);
+      const markers2 = await selectMany(testDb.db, esOperationsTable);
       expect(markers2).toHaveLength(1);
     } finally {
       rmSync(dir, { recursive: true, force: true });
@@ -130,7 +132,7 @@ describe("runPendingSeedMigrations (integration)", () => {
         }),
       ).rejects.toThrow(/boom/);
 
-      const markers = await testDb.db.select().from(esOperationsTable);
+      const markers = await selectMany(testDb.db, esOperationsTable);
       expect(markers).toHaveLength(0);
     } finally {
       rmSync(dir, { recursive: true, force: true });
@@ -192,14 +194,14 @@ describe("runPendingSeedMigrations (integration)", () => {
     ]);
     try {
       const dispatcher = {
-        write: vi.fn(async () => ({
+        write: mock(async () => ({
           isSuccess: false as const,
           error: { code: "version_conflict", message: "stream changed" },
         })),
-        query: vi.fn(),
-        command: vi.fn(),
-        batch: vi.fn(),
-        resolveAuthClaims: vi.fn(),
+        query: mock(),
+        command: mock(),
+        batch: mock(),
+        resolveAuthClaims: mock(),
       };
 
       await expect(
@@ -214,7 +216,7 @@ describe("runPendingSeedMigrations (integration)", () => {
       ).rejects.toThrow(/version_conflict/);
 
       // Kein Marker — bei nächstem Boot würde der Seed retried
-      const markers = await testDb.db.select().from(esOperationsTable);
+      const markers = await selectMany(testDb.db, esOperationsTable);
       expect(markers).toHaveLength(0);
     } finally {
       rmSync(dir, { recursive: true, force: true });
@@ -264,7 +266,7 @@ describe("runPendingSeedMigrations (integration)", () => {
       expect(dispatcher.write).toHaveBeenCalledTimes(1);
       // Marker NICHT gesetzt — retry beim nächsten Boot wird die Migration
       // nochmal ausführen. Wenn der Write nicht idempotent ist → Duplikat.
-      const markers = await testDb.db.select().from(esOperationsTable);
+      const markers = await selectMany(testDb.db, esOperationsTable);
       expect(markers).toHaveLength(0);
     } finally {
       rmSync(dir, { recursive: true, force: true });
@@ -293,7 +295,7 @@ describe("runPendingSeedMigrations (integration)", () => {
     ]);
     try {
       // Pre-seed marker als wäre ein parallel-Pod schon durch
-      await testDb.db.insert(esOperationsTable).values({
+      await insertOne(testDb.db, esOperationsTable, {
         id: "2026-05-20-race",
         operationType: "seed-migration",
         durationMs: 42,
@@ -318,7 +320,7 @@ describe("runPendingSeedMigrations (integration)", () => {
       });
 
       expect(dispatcher.write).not.toHaveBeenCalled();
-      const markers = await testDb.db.select().from(esOperationsTable);
+      const markers = await selectMany(testDb.db, esOperationsTable);
       expect(markers).toHaveLength(1); // nur der pre-seeded
     } finally {
       rmSync(dir, { recursive: true, force: true });
@@ -354,7 +356,7 @@ describe("runPendingSeedMigrations (integration)", () => {
       ).rejects.toThrow(/stop here/);
 
       // Nur first hat marker — fails warf, never wurde nie attempted
-      const markers = await testDb.db.select().from(esOperationsTable);
+      const markers = await selectMany(testDb.db, esOperationsTable);
       expect(markers.map((m) => m.id)).toEqual(["2026-05-19-first"]);
     } finally {
       rmSync(dir, { recursive: true, force: true });

package/src/es-ops/__tests__/runner.test.ts

@@ -2,10 +2,10 @@
 // dispatcher-call) testen wir gegen Postgres in der integration-test.
 // Hier nur die pure-logic-Pfade die kein echtes DB brauchen.
 
+import { describe, expect, test } from "bun:test";
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { describe, expect, test } from "vitest";
 import { runPendingSeedMigrations } from "../runner";
 
 function makeTempSeedsDir(files: readonly { name: string; content: string }[]): string {
@@ -14,31 +14,41 @@ function makeTempSeedsDir(files: readonly { name: string; content: string }[]):
   return dir;
 }
 
-// Minimal DB-Stub — Runner ruft transaction() + select() + insert() +
-// execute() auf. execute() liefert ein leeres array für den
-// re-check-inside-lock (= "nicht applied, weiter mit Run").
+// Minimal DB-Stub — Runner uses bun-db helpers (selectMany, insertOne) +
+// asRawClient(tx).unsafe(...) for the advisory lock + re-check + insert.
+// Returns parsed rows based on the SQL text shape:
+//   SELECT * FROM "kumiko_es_operations" ...  → applied-set rows
+//   SELECT pg_advisory_xact_lock(...)         → ignored
+//   SELECT 1 FROM "kumiko_es_operations" ...  → empty (= not applied)
+//   INSERT INTO "kumiko_es_operations" ...    → record + add to applied
 function makeStubDb(initialApplied: readonly string[] = []) {
   const inserts: Array<Record<string, unknown>> = [];
   const applied = new Set(initialApplied);
+  const unsafe = async (
+    sqlText: string,
+    params?: readonly unknown[],
+  ): Promise<readonly unknown[]> => {
+    if (/SELECT \* FROM "kumiko_es_operations"/.test(sqlText)) {
+      return Array.from(applied).map((id) => ({
+        id,
+        operationType: "seed-migration",
+      }));
+    }
+    if (/INSERT INTO "kumiko_es_operations"/.test(sqlText)) {
+      const id = String(params?.[0]);
+      inserts.push({ id });
+      applied.add(id);
+      return [{ id }];
+    }
+    // pg_advisory_xact_lock + re-check both yield empty → "not applied, run".
+    return [];
+  };
   const db = {
+    unsafe,
+    begin: async (cb: (tx: unknown) => Promise<unknown>) => cb(db),
     transaction: async (cb: (tx: unknown) => Promise<void>) => {
       await cb(db);
     },
-    select: () => ({
-      from: () => ({
-        where: async () => Array.from(applied).map((id) => ({ id })),
-      }),
-    }),
-    insert: () => ({
-      values: async (row: Record<string, unknown>) => {
-        inserts.push(row);
-        if (typeof row["id"] === "string") applied.add(row["id"]);
-      },
-    }),
-    // execute: für pg_advisory_xact_lock + re-check. Leere Liste = "nicht
-    // applied im Inner-Lock-Scope, weiter mit Run". applied-set check via
-    // select() oben wird sowieso schon angewendet.
-    execute: async (_q: unknown) => [],
   };
   return { db, inserts, applied };
 }

package/src/es-ops/context.ts

@@ -7,8 +7,12 @@
 // config-seed.ts:40). Events haben createdBy = SYSTEM_TENANT_ID-User
 // → audit-fähig.
 
-import { sql } from "drizzle-orm";
 import type { DbRunner } from "../db";
+import {
+  selectAllTenants,
+  selectMembershipsOfUser,
+  selectUserByEmail,
+} from "../db/queries/seed-context";
 import { createSystemUser, SYSTEM_TENANT_ID } from "../engine";
 import type { Dispatcher } from "../pipeline/dispatcher";
 import type { SeedMembershipRow, SeedMigrationContext, SeedTenantRow } from "./types";
@@ -59,46 +63,13 @@ export function createSeedMigrationContext(
     },
 
     findUserByEmail: async (email) => {
-      // Direct DB-Read via read_users-Projection (gleicher Pfad wie
-      // UserQueries.findForAuth aber ohne Dispatcher-Roundtrip; Seeds
-      // greifen oft 1-N Lookups → direkt schneller).
-      // @cast-boundary db-row — drizzle execute(sql) returns row-array
-      // direkt (kein { rows }-Wrapper); column-types vom SQL-Cast oben
-      const rows = (await args.dbRunner.execute(
-        sql`SELECT id::text AS id, email, tenant_id::text AS tenant_id
-            FROM read_users
-            WHERE email = ${email}
-            LIMIT 1`,
-      )) as unknown as readonly { id: string; email: string; tenant_id: string }[];
-      const row = rows[0];
+      const row = await selectUserByEmail(args.dbRunner, email);
       if (!row) return null;
-      return { id: row.id, email: row.email, tenantId: row.tenant_id };
+      return { id: row.id, email: row.email, tenantId: row.tenantId };
     },
 
     findMembershipsOfUser: async (userId) => {
-      // INNER JOIN auf kumiko_events um den stream-tenant (events.tenant_id
-      // der v1-Row) neben dem payload-tenant (memberships.tenant_id) zu
-      // liefern. Die beiden divergieren wenn das Aggregate von einem
-      // Executor mit fremder tenantId angelegt wurde (seedTenantMembership
-      // by=systemAdmin) — typischer publicstatus-Driver-Use-Case.
-      // INNER (nicht LEFT): kein v1-Event bei vorhandener Read-Row wäre
-      // Data-Drift, kein legitimer Zustand für Seed-Migrations.
-      // @cast-boundary db-row — roles ist JSON-string in der text-Spalte
-      // (Memory: tenant-membership.created payload "[\"User\"]"), wird unten geparst
-      const rows = (await args.dbRunner.execute(
-        sql`SELECT m.user_id::text AS user_id,
-                   m.tenant_id::text AS tenant_id,
-                   e.tenant_id::text AS stream_tenant_id,
-                   m.roles
-            FROM read_tenant_memberships m
-            JOIN kumiko_events e ON e.aggregate_id = m.id AND e.version = 1
-            WHERE m.user_id = ${userId}`,
-      )) as unknown as readonly {
-        user_id: string;
-        tenant_id: string;
-        stream_tenant_id: string;
-        roles: string;
-      }[];
+      const rows = await selectMembershipsOfUser(args.dbRunner, userId);
       return rows.map(
         (r): SeedMembershipRow => ({
           userId: r.user_id,
@@ -110,12 +81,7 @@ export function createSeedMigrationContext(
     },
 
     findTenants: async () => {
-      // @cast-boundary db-row
-      const rows = (await args.dbRunner.execute(
-        sql`SELECT id::text AS id, name, tenant_key
-            FROM read_tenants
-            ORDER BY inserted_at`,
-      )) as unknown as readonly { id: string; name: string; tenant_key: string }[];
+      const rows = await selectAllTenants(args.dbRunner);
       return rows.map((r): SeedTenantRow => ({ id: r.id, name: r.name, tenantKey: r.tenant_key }));
     },
 

package/src/es-ops/operations-schema.ts

@@ -10,9 +10,9 @@
 //   bunx kumiko ops seed:status      → operation_type = "seed-migration"
 //   bunx kumiko ops projection:status → operation_type = "projection-rebuild"
 
-import { sql } from "drizzle-orm";
+// sql now comes from native dialect
 import { type DbConnection, tableExists } from "../db";
-import { index, integer, table as pgTable, text, timestamp } from "../db/dialect";
+import { index, integer, table as pgTable, sql, text, timestamp } from "../db/dialect";
 import { unsafePushTables } from "../stack";
 
 export type EsOperationType = "seed-migration";