@cosmicdrift/kumiko-framework 0.14.0 → 0.16.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.14.0",
+  "version": "0.16.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -20,7 +20,6 @@
     "command-based",
     "typescript",
     "hono",
-    "drizzle",
     "zod"
   ],
   "type": "module",
@@ -60,6 +59,10 @@
       "types": "./src/errors/index.ts",
       "default": "./src/errors/index.ts"
     },
+    "./bun-db": {
+      "types": "./src/bun-db/index.ts",
+      "default": "./src/bun-db/index.ts"
+    },
     "./db": {
       "types": "./src/db/index.ts",
       "default": "./src/db/index.ts"
@@ -157,8 +160,6 @@
   "dependencies": {
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
-    "drizzle-kit": "^0.31.10",
-    "drizzle-orm": "^0.45.2",
     "hono": "^4.12.18",
     "i18next": "^26.1.0",
     "ioredis": "^5.10.1",
@@ -175,7 +176,6 @@
     "@cosmicdrift/kumiko-dispatcher-live": "0.14.0",
     "@types/uuid": "^11.0.0",
     "bun-types": "^1.3.13",
-    "drizzle-kit": "^0.31.10",
     "pino-pretty": "^13.1.3"
   },
   "publishConfig": {
@@ -187,4 +187,4 @@
     "README.md",
     "LICENSE"
   ]
-}
+}

package/src/__tests__/{anonymous-access.integration.ts → anonymous-access.integration.test.ts}

@@ -3,11 +3,14 @@
 // authentication. Covers the resolution chain (defaultTenantId, X-Tenant
 // header, kumiko_tenant cookie, custom resolver) plus the rejection paths
 // (no tenant, unknown tenant, openToAll-protected).
+//
+// Bun.SQL-only setup. KEIN postgres-js, KEIN setupTestStack.
 
-import { afterAll, beforeAll, beforeEach, describe, expect, test } from "vitest";
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { z } from "zod";
 import { createEventStoreExecutor } from "../db/event-store-executor";
-import { buildDrizzleTable } from "../db/table-builder";
+import { asRawClient, selectMany } from "../db/query";
+import { buildEntityTable } from "../db/table-builder";
 import {
   ANONYMOUS_USER_ID,
   createEntity,
@@ -28,7 +31,7 @@ const productEntity = createEntity({
     name: createTextField({ required: true }),
   },
 });
-const productTable = buildDrizzleTable("product", productEntity);
+const productTable = buildEntityTable("product", productEntity);
 
 const orderEntity = createEntity({
   table: "anon_orders",
@@ -37,7 +40,7 @@ const orderEntity = createEntity({
     placedBy: createTextField({ default: "" }),
   },
 });
-const orderTable = buildDrizzleTable("order", orderEntity);
+const orderTable = buildEntityTable("order", orderEntity);
 
 const shopFeature = defineFeature("anonshop", (r) => {
   r.entity("product", productEntity);
@@ -48,7 +51,7 @@ const shopFeature = defineFeature("anonshop", (r) => {
     "product:list",
     z.object({}),
     async (_event, ctx) => {
-      const rows = await ctx.db.select().from(productTable);
+      const rows = await selectMany(ctx.db, productTable);
       return rows;
     },
     { access: { roles: ["anonymous", "User", "Admin"] } },
@@ -59,7 +62,7 @@ const shopFeature = defineFeature("anonshop", (r) => {
     "product:list-auth-only",
     z.object({}),
     async (_event, ctx) => {
-      const rows = await ctx.db.select().from(productTable);
+      const rows = await selectMany(ctx.db, productTable);
       return rows;
     },
     { access: { openToAll: true } },
@@ -111,8 +114,8 @@ describe("anonymous access — single-tenant default", () => {
   afterAll(() => stack.cleanup());
 
   beforeEach(async () => {
-    await stack.db.delete(productTable);
-    await stack.db.delete(orderTable);
+    await asRawClient(stack.db).unsafe(`DELETE FROM "${productTable.tableName}"`);
+    await asRawClient(stack.db).unsafe(`DELETE FROM "${orderTable.tableName}"`);
   });
 
   test("anonymous query succeeds without any auth headers", async () => {
@@ -146,7 +149,7 @@ describe("anonymous access — single-tenant default", () => {
 
     // Verify the row landed with placedBy=anonymous in the DB. Confirms the
     // synthesised SessionUser actually flows through to the handler.
-    const rows = await stack.db.select().from(orderTable);
+    const rows = await selectMany(stack.db, orderTable);
     expect(rows).toHaveLength(1);
     expect(rows[0]?.["placedBy"]).toBe(ANONYMOUS_USER_ID);
   });

package/src/__tests__/{error-contract.integration.ts → error-contract.integration.test.ts}

@@ -3,10 +3,11 @@
 // come back with a stable code + i18nKey and the shape that the client SDK
 // and docs promise. If you change the contract, this is the file that moves.
 
-import { afterAll, beforeAll, beforeEach, describe, expect, test } from "vitest";
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { z } from "zod";
 import { createEventStoreExecutor } from "../db/event-store-executor";
-import { buildDrizzleTable } from "../db/table-builder";
+import { asRawClient } from "../db/query";
+import { buildEntityTable } from "../db/table-builder";
 import {
   createEntity,
   createNumberField,
@@ -38,7 +39,7 @@ const itemEntity = createEntity({
     stock: createNumberField({ default: 0 }),
   },
 });
-const itemTable = buildDrizzleTable("item", itemEntity);
+const itemTable = buildEntityTable("item", itemEntity);
 
 const errorFeature = defineFeature("errctr", (r) => {
   r.entity("item", itemEntity);
@@ -192,7 +193,7 @@ beforeAll(async () => {
 afterAll(async () => stack.cleanup());
 beforeEach(async () => {
   stack.events.reset();
-  await stack.db.delete(itemTable);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${itemTable.tableName}"`);
 });
 
 // --- Helpers ---

package/src/__tests__/{field-access.integration.ts → field-access.integration.test.ts}

@@ -1,8 +1,8 @@
-import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { z } from "zod";
 import { buildServer } from "../api/server";
 import { createEventStoreExecutor } from "../db/event-store-executor";
-import { buildDrizzleTable } from "../db/table-builder";
+import { buildEntityTable } from "../db/table-builder";
 import {
   createEntity,
   createNumberField,
@@ -33,7 +33,7 @@ const employeeEntity = createEntity({
   },
 });
 
-const employeeTable = buildDrizzleTable("employee", employeeEntity);
+const employeeTable = buildEntityTable("employee", employeeEntity);
 
 // --- Test infra ---
 

package/src/__tests__/{full-stack.integration.ts → full-stack.integration.test.ts}

@@ -1,6 +1,7 @@
-import { afterAll, beforeAll, beforeEach, describe, expect, test } from "vitest";
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { z } from "zod";
 import { createEventStoreExecutor } from "../db/event-store-executor";
+import { selectMany, updateMany } from "../db/query";
 import { defineFeature, type EntityId, type HandlerContext, type SaveContext } from "../engine";
 import { UnprocessableError, writeFailure } from "../errors";
 import { eventsTable } from "../event-store";
@@ -714,11 +715,7 @@ describe("full stack: entity cache", () => {
     await stack.http.queryOk("users:query:user:detail", { id }, adminUser);
 
     // Raw DB update — bypasses cache invalidation
-    const { eq } = await import("drizzle-orm");
-    await stack.db
-      .update(userTable)
-      .set({ firstName: "RawDbChange" })
-      .where(eq(userTable["id"], id));
+    await updateMany(stack.db, userTable, { firstName: "RawDbChange" }, { id: id });
 
     // Detail still returns cached (old) value
     const stale = await stack.http.queryOk<Record<string, unknown>>(
@@ -789,16 +786,10 @@ describe("full stack: ctx.appendEvent via event-dispatcher", () => {
   // events table is shared across tests so we pick out just the ones this
   // test appended.
   async function domainEventsForEmail(email: string) {
-    const rows = await stack.db
-      .select()
-      .from(eventsTable)
-      .where(
-        // eq + and via a lazy dynamic import keeps the top-level imports lean.
-        (await import("drizzle-orm")).and(
-          (await import("drizzle-orm")).eq(eventsTable.aggregateType, "user"),
-          (await import("drizzle-orm")).eq(eventsTable.type, USER_CREATED_EVENT),
-        ),
-      );
+    const rows = await selectMany(stack.db, eventsTable, {
+      aggregateType: "user",
+      type: USER_CREATED_EVENT,
+    });
     return rows.filter((r) => (r.payload as { email?: string }).email === email);
   }
 

package/src/__tests__/{ownership.integration.ts → ownership.integration.test.ts}

@@ -4,7 +4,8 @@
 // entity-write, field-level) into one file with shared fixtures. Each
 // `describe` block maps to a cell of the core-auth.md Policy-Matrix.
 
-import { afterAll, beforeAll, beforeEach, describe, expect, test } from "vitest";
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { asRawClient } from "../db/query";
 import {
   createEntity,
   createTextField,
@@ -134,7 +135,7 @@ let engRow: { id: string; version: number };
 let opsRow: { id: string; version: number };
 
 beforeEach(async () => {
-  await stack.db.execute("DELETE FROM h2_contracts");
+  await asRawClient(stack.db).unsafe("DELETE FROM h2_contracts");
   const eng = await stack.http.writeOk<{ id: string; data: { version: number } }>(
     "h2contracts:write:contract:create",
     {

package/src/__tests__/{raw-table.integration.ts → raw-table.integration.test.ts}

@@ -3,9 +3,9 @@
 // INSERT/SELECT against the real DB roundtrip. Plan reference:
 // kumiko-platform/docs/plans/architecture/table-ddl-guard.md (Stufe 3).
 
-import { eq, sql } from "drizzle-orm";
-import { pgTable, text, timestamp } from "drizzle-orm/pg-core";
-import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { table, text, timestamp } from "../db/dialect";
+import { asRawClient, insertOne, selectMany } from "../db/query";
 import { defineFeature } from "../engine";
 import { setupTestStack, type TestStack, unsafePushTables } from "../stack";
 
@@ -13,7 +13,7 @@ import { setupTestStack, type TestStack, unsafePushTables } from "../stack";
 // write-only by an integration handler, read-only by a query, never
 // event-sourced (the data isn't a domain fact, it's a side-effect
 // snapshot).
-const stripeWebhookCache = pgTable("rt_int_stripe_webhook_cache", {
+const stripeWebhookCache = table("rt_int_stripe_webhook_cache", {
   eventId: text("event_id").primaryKey(),
   payload: text("payload").notNull(),
   receivedAt: timestamp("received_at", { withTimezone: true }).notNull().defaultNow(),
@@ -22,7 +22,7 @@ const stripeWebhookCache = pgTable("rt_int_stripe_webhook_cache", {
 // A second physical table reachable through two distinct r.rawTable
 // registrations — pins the seenTables-by-reference dedupe at push time.
 // Two logical names, one CREATE.
-const sharedSyncCache = pgTable("rt_int_shared_sync_cache", {
+const sharedSyncCache = table("rt_int_shared_sync_cache", {
   syncId: text("sync_id").primaryKey(),
   payload: text("payload").notNull(),
 });
@@ -54,16 +54,13 @@ describe("r.rawTable — DB roundtrip via setupTestStack", () => {
     const eventId = "evt_test_123";
     const payload = JSON.stringify({ type: "invoice.paid", amount: 4200 });
 
-    await stack.db.insert(stripeWebhookCache).values({ eventId, payload });
+    await insertOne(stack.db, stripeWebhookCache, { eventId, payload });
 
-    const rows = await stack.db
-      .select()
-      .from(stripeWebhookCache)
-      .where(eq(stripeWebhookCache.eventId, eventId));
+    const rows = await selectMany(stack.db, stripeWebhookCache, { eventId: eventId });
 
     expect(rows).toHaveLength(1);
     expect(rows[0]?.payload).toBe(payload);
-    expect(rows[0]?.receivedAt).toBeInstanceOf(Date);
+    expect(rows[0]?.receivedAt).toBeInstanceOf(Temporal.Instant);
   });
 
   test("registry exposes the raw table with its reason and featureName", () => {
@@ -80,18 +77,18 @@ describe("r.rawTable — DB roundtrip via setupTestStack", () => {
     // a write to it shouldn't append anything to kumiko_events. If a
     // future regression accidentally routed raw-table writes through
     // the executor, a row would show up here.
-    const before = await stack.db.execute<{ count: string }>(
-      sql`SELECT COUNT(*)::text AS count FROM kumiko_events`,
+    const before = await asRawClient(stack.db).unsafe<{ count: string }>(
+      `SELECT COUNT(*)::text AS count FROM kumiko_events`,
     );
     const beforeCount = Number(before[0]?.count ?? 0);
 
-    await stack.db.insert(stripeWebhookCache).values({
+    await insertOne(stack.db, stripeWebhookCache, {
       eventId: "evt_no_event_emitted",
       payload: "{}",
     });
 
-    const after = await stack.db.execute<{ count: string }>(
-      sql`SELECT COUNT(*)::text AS count FROM kumiko_events`,
+    const after = await asRawClient(stack.db).unsafe<{ count: string }>(
+      `SELECT COUNT(*)::text AS count FROM kumiko_events`,
     );
     const afterCount = Number(after[0]?.count ?? 0);
 
@@ -103,11 +100,8 @@ describe("r.rawTable — DB roundtrip via setupTestStack", () => {
     // setupTestStack dedupe (seenTables-by-table-reference) had silently
     // broken, beforeAll's setupTestStack would have raised a 42P07 on
     // the second push and never reached this test.
-    await stack.db.insert(sharedSyncCache).values({ syncId: "sync_1", payload: "{}" });
-    const rows = await stack.db
-      .select()
-      .from(sharedSyncCache)
-      .where(eq(sharedSyncCache.syncId, "sync_1"));
+    await insertOne(stack.db, sharedSyncCache, { syncId: "sync_1", payload: "{}" });
+    const rows = await selectMany(stack.db, sharedSyncCache, { syncId: "sync_1" });
     expect(rows).toHaveLength(1);
     // Both registrations are visible in the registry — same physical
     // target, different logical handles.
@@ -115,14 +109,8 @@ describe("r.rawTable — DB roundtrip via setupTestStack", () => {
     expect(stack.registry.getAllRawTables().get("secondary-sync")?.table).toBe(sharedSyncCache);
   });
 
-  test("a second push on the same rawTable would crash — proves tableExists-filter is load-bearing", async () => {
-    // The setupTestStack push is idempotent because it filters by
-    // tableExists before calling unsafePushTables (which is itself
-    // strict — that's the contract of the unsafe-prefix). Pin the
-    // failure mode of the unfiltered call: a direct second push on
-    // the same Drizzle schema raises the underlying PG error. This
-    // is the negative form of the idempotency contract — without the
-    // filter, a re-boot against a persistent dev DB would crash here.
-    await expect(unsafePushTables(stack.db, { idem: stripeWebhookCache })).rejects.toThrow();
+  test("a second push on the same rawTable is idempotent — CREATE IF NOT EXISTS", async () => {
+    // unsafePushTables uses CREATE TABLE IF NOT EXISTS — idempotent by design.
+    await expect(unsafePushTables(stack.db, { idem: stripeWebhookCache })).resolves.toBeUndefined();
   });
 });

package/src/__tests__/{reference-data.integration.ts → reference-data.integration.test.ts}

@@ -1,8 +1,11 @@
-import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { type BunTestDb, createTestDb } from "../bun-db/__tests__/bun-test-db";
 import { integer, table as pgTable, serial, text } from "../db/dialect";
+import { selectMany } from "../db/query";
 import { seedReferenceData } from "../db/reference-data";
 import type { ReferenceDataDef } from "../engine/types";
-import { createTestDb, type TestDb, unsafePushTables } from "../stack";
+import { unsafePushTables } from "../stack";
+import { ensureTemporalPolyfill } from "../time/polyfill";
 
 // --- Tables ---
 
@@ -21,9 +24,10 @@ const statusTable = pgTable("ref_statuses", {
 
 // --- Test state ---
 
-let testDb: TestDb;
+let testDb: BunTestDb;
 
 beforeAll(async () => {
+  await ensureTemporalPolyfill();
   testDb = await createTestDb();
   await unsafePushTables(testDb.db, { countryTable, statusTable });
 });
@@ -34,13 +38,13 @@ afterAll(async () => {
 
 // Helper: read all rows from a table
 async function readCountries() {
-  const rows = await testDb.db.select().from(countryTable);
-  return rows.sort((a, b) => a.code.localeCompare(b.code));
+  const rows = await selectMany(testDb.db, countryTable);
+  return rows.toSorted((a, b) => a.code.localeCompare(b.code));
 }
 
 async function readStatuses() {
-  const rows = await testDb.db.select().from(statusTable);
-  return rows.sort((a, b) => (a.sortOrder ?? 0) - (b.sortOrder ?? 0));
+  const rows = await selectMany(testDb.db, statusTable);
+  return rows.toSorted((a, b) => (a.sortOrder ?? 0) - (b.sortOrder ?? 0));
 }
 
 describe("seedReferenceData", () => {
@@ -132,7 +136,10 @@ describe("seedReferenceData", () => {
 
     const rows = await readCountries();
     expect(rows).toHaveLength(4);
-    expect(rows.find((r) => r.code === "CH")).toMatchObject({ name: "Schweiz", region: "Europe" });
+    expect(rows.find((r: Record<string, unknown>) => r["code"] === "CH")).toMatchObject({
+      name: "Schweiz",
+      region: "Europe",
+    });
   });
 
   test("custom upsertKey — matches on specified field instead of first", async () => {
@@ -167,9 +174,15 @@ describe("seedReferenceData", () => {
     expect(updateResult).toEqual({ inserted: 0, updated: 1 });
 
     const rows = await readStatuses();
-    expect(rows.find((r) => r.slug === "draft")).toMatchObject({ label: "Entwurf" });
-    expect(rows.find((r) => r.slug === "active")).toMatchObject({ label: "Active" });
-    expect(rows.find((r) => r.slug === "archived")).toMatchObject({ label: "Archived" });
+    expect(rows.find((r: Record<string, unknown>) => r["slug"] === "draft")).toMatchObject({
+      label: "Entwurf",
+    });
+    expect(rows.find((r: Record<string, unknown>) => r["slug"] === "active")).toMatchObject({
+      label: "Active",
+    });
+    expect(rows.find((r: Record<string, unknown>) => r["slug"] === "archived")).toMatchObject({
+      label: "Archived",
+    });
   });
 
   test("skips unknown entity names gracefully", async () => {

package/src/__tests__/{transition-guard.integration.ts → transition-guard.integration.test.ts}

@@ -1,7 +1,8 @@
-import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { z } from "zod";
 import { createEventStoreExecutor } from "../db/event-store-executor";
-import { buildDrizzleTable } from "../db/table-builder";
+import { updateMany } from "../db/query";
+import { buildEntityTable } from "../db/table-builder";
 import {
   createBooleanField,
   createEntity,
@@ -67,9 +68,9 @@ const ticketEntity = createEntity({
   },
 });
 
-const invoiceTable = buildDrizzleTable("invoice", invoiceEntity);
-const orderTable = buildDrizzleTable("order", orderEntity);
-const ticketTable = buildDrizzleTable("ticket", ticketEntity);
+const invoiceTable = buildEntityTable("invoice", invoiceEntity);
+const orderTable = buildEntityTable("order", orderEntity);
+const ticketTable = buildEntityTable("ticket", ticketEntity);
 
 const feature = defineFeature("txguard", (r) => {
   r.entity("invoice", invoiceEntity);
@@ -267,11 +268,12 @@ describe("auto transition guard: per-entity transition map (cache key includes e
     // Raw-DB-mark-deleted — we need a soft-deleted row whose status is a
     // terminal state. If the guard fired, any status write would throw
     // "Invalid transition: closed → <x>". We want it silently skipped.
-    const { eq } = await import("drizzle-orm");
-    await stack.db
-      .update(ticketTable)
-      .set({ status: "closed", isDeleted: true })
-      .where(eq(ticketTable["id"], ticket["id"]));
+    await updateMany(
+      stack.db,
+      ticketTable,
+      { status: "closed", isDeleted: true },
+      { id: ticket["id"] },
+    );
 
     // Attempting to move a deleted ticket to "open" would normally violate
     // "closed → []" (no allowed targets). With the softDelete skip, the

package/src/api/__tests__/api.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, test } from "vitest";
+import { describe, expect, test } from "bun:test";
 import { z } from "zod";
 import {
   createEntity,

package/src/api/__tests__/auth-middleware-transport.test.ts

@@ -2,8 +2,8 @@
 // against a hand-rolled Hono app — no DB, no dispatcher. Exercises the
 // transport-extraction path that drives the csrf-middleware downstream.
 
+import { describe, expect, test } from "bun:test";
 import { Hono } from "hono";
-import { describe, expect, test } from "vitest";
 import { TestUsers } from "../../stack";
 import { AUTH_COOKIE_NAME, authMiddleware, getAuthTransport, getUser } from "../auth-middleware";
 import { createJwtHelper } from "../jwt";

package/src/api/__tests__/auth-routes-cookie.test.ts

@@ -5,9 +5,9 @@
 // logic — full-stack login via real loginHandler is covered by the
 // auth-cookie sample integration test.
 
+import { describe, expect, test } from "bun:test";
 import type { Hono } from "hono";
 import { Hono as HonoCtor } from "hono";
-import { describe, expect, test } from "vitest";
 import type { SessionUser } from "../../engine/types";
 import type { BatchResult, Dispatcher, WriteResult } from "../../pipeline/dispatcher";
 import { TestUsers } from "../../stack";