@cosmicdrift/kumiko-bundled-features 0.366.0 → 0.368.0

package/dist/template-resolver/seeding.js

@@ -8,15 +8,15 @@
 //
 // Default ifExists="skip". The actor is `createSystemUser(SYSTEM_TENANT_ID)`,
 // deliberately not TestUsers (prod seeds are not test utilities).
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createTenantDb, deleteMany, } from "@cosmicdrift/kumiko-framework/db";
+import { createTenantDb, deleteMany, fetchOne, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { getStreamVersion, getUnscopedStreamMaxVersionForSeed, } from "@cosmicdrift/kumiko-framework/event-store";
 import { runEventStoreSeed } from "@cosmicdrift/kumiko-framework/seeding";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { TEXT_BLOCK_KIND } from "./constants.js";
 import { executor } from "./handlers/shared.js";
 import { evaluateTemplateWrite } from "./handlers/template-gates.js";
-import { TEMPLATE_RESOLVER_FEATURE } from "./qualified-names.js";
+import { TEMPLATE_RESOLVER_FEATURE, TemplateResolverHandlers } from "./qualified-names.js";
 import { templateResourcesTable } from "./table.js";
 import { activeStampChanges, servedStampChanges } from "./template-draft.js";
 import { templateSlugSchema } from "./template-meta.js";
@@ -43,7 +43,7 @@ async function resolveExistingForEventStoreSeed(db, tdb, existingRow, tenantId)
 export async function seedSystemTemplate(db, opts) {
     const tenantId = SYSTEM_TENANT_ID;
     const by = opts.by ?? createSystemUser(tenantId);
-    const tdb = createTenantDb(db, tenantId, "system");
+    const tdb = createTenantDb({ db, tenantId, mode: "system" });
     const label = `seedSystemTemplate ${opts.slug}/${opts.kind}/${opts.locale}`;
     const slug = templateSlugSchema.safeParse(opts.slug);
     if (!slug.success)
@@ -154,12 +154,12 @@ export async function seedSystemTemplate(db, opts) {
         update: (row) => applyUpdate(row, existingRow),
     });
 }
-// Seeds one system row per bundle locale. Bundled resources need a file
-// provider and the system tenant's file space, which a boot seed does not
-// have, so those go through the import-bundle-system write instead.
+// Seeds one system row per bundle locale. Bundled resources need a file provider and
+// the system tenant's file space, so those bundles are written through the
+// import-bundle-system handler on the seed dispatcher instead of directly.
 export async function seedSystemTemplateBundle(db, bundle, opts = {}) {
     if (Object.keys(bundle.resources).length > 0) {
-        throw new Error(`seedSystemTemplateBundle ${bundle.slug}/${bundle.kind}: bundles with resources cannot be seeded; use the import-bundle-system write`);
+        return seedSystemTemplateBundleWithResources(db, bundle, opts);
     }
     const ids = {};
     for (const [locale, entry] of Object.entries(bundle.locales)) {
@@ -178,6 +178,40 @@ export async function seedSystemTemplateBundle(db, bundle, opts = {}) {
     }
     return { ids };
 }
+async function seedSystemTemplateBundleWithResources(db, bundle, opts) {
+    const label = `seedSystemTemplateBundle ${bundle.slug}/${bundle.kind}`;
+    const { dispatcher } = opts;
+    if (!dispatcher) {
+        throw new Error(`${label}: bundles with resources need a file provider; pass opts.dispatcher (the dispatcher of the seed deps) so the files are stored through the import-bundle-system write`);
+    }
+    if ((opts.ifExists ?? "skip") === "skip") {
+        const existingIds = {};
+        for (const locale of Object.keys(bundle.locales)) {
+            const row = await fetchOne(db, templateResourcesTable, {
+                tenantId: SYSTEM_TENANT_ID,
+                slug: bundle.slug,
+                kind: bundle.kind,
+                locale,
+            });
+            if (row)
+                existingIds[locale] = String(row.id);
+        }
+        if (Object.keys(existingIds).length === Object.keys(bundle.locales).length) {
+            return { ids: existingIds };
+        }
+    }
+    const result = await dispatcher.write(TemplateResolverHandlers.importBundleSystem, { bundle }, opts.by ?? createSystemUser(SYSTEM_TENANT_ID, ["SystemAdmin"]));
+    if (!result.isSuccess) {
+        throw new Error(`${label} failed: ${result.error.code}: ${result.error.message}`);
+    }
+    return { ids: importedIds(result.data) };
+}
+function importedIds(data) {
+    const ids = isPlainObject(data) ? data["ids"] : undefined;
+    if (!isPlainObject(ids))
+        throw new Error("seedSystemTemplateBundle: import returned no ids");
+    return Object.fromEntries(Object.entries(ids).map(([locale, id]) => [locale, String(id)]));
+}
 export function hasNotificationTemplates(registry) {
     return Array.from(registry.getAllNotifications().values()).some((notification) => notification.template !== undefined);
 }
@@ -215,7 +249,7 @@ export async function seedNotificationTemplates(db, registry) {
 // without the access check. Default ifExists="skip".
 export async function seedTextBlock(db, opts) {
     const by = opts.by ?? createSystemUser(opts.tenantId);
-    const tdb = createTenantDb(db, opts.tenantId, "system");
+    const tdb = createTenantDb({ db, tenantId: opts.tenantId, mode: "system" });
     const existingRow = await fetchOne(db, templateResourcesTable, {
         tenantId: opts.tenantId,
         slug: opts.slug,

package/dist/template-resolver/store-template-resource.js

@@ -1,4 +1,4 @@
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { NotFoundError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { createFileRefFromUploadedBytes, uploadFileBytesBeforeTransaction, } from "@cosmicdrift/kumiko-framework/files";
 import { fileContextForTenant } from "../file-foundation/index.js";

package/dist/template-resolver/template-preview.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { NotFoundError, UnprocessableError, ValidationError, } from "@cosmicdrift/kumiko-framework/errors";
 import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import { escapeHtml } from "@cosmicdrift/kumiko-headless";
@@ -33,6 +33,8 @@ function sampleScalar(name, def) {
             return 0;
         case "date":
             return SAMPLE_DATE;
+        case "percent":
+            return 0;
     }
 }
 function sampleRow(item, given = {}) {

package/dist/template-resolver/template-resources.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import { requireForTenant } from "../shared/index.js";

package/dist/template-resolver/template-system-only.d.ts

@@ -0,0 +1,8 @@
+import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
+export declare function isSystemOnlyTemplate(registry: Registry, slug: string, kind: string): boolean;
+export declare function isSystemOnlyTemplateHiddenFrom(user: {
+    readonly roles: readonly string[];
+}, registry: Registry, row: {
+    readonly slug: string;
+    readonly kind: string;
+}): boolean;

package/dist/template-resolver/template-system-only.js

@@ -0,0 +1,11 @@
+import { isSystemAdmin } from "./template-draft.js";
+const NOTIFICATION_TEMPLATE_KIND = "mail";
+// A notification registered with systemOnly keeps its mail template as the system default:
+// tenants neither list nor override it, and overrides stored before the flag are ignored.
+export function isSystemOnlyTemplate(registry, slug, kind) {
+    return (kind === NOTIFICATION_TEMPLATE_KIND &&
+        registry.getAllNotifications().get(slug)?.systemOnly === true);
+}
+export function isSystemOnlyTemplateHiddenFrom(user, registry, row) {
+    return !isSystemAdmin(user) && isSystemOnlyTemplate(registry, row.slug, row.kind);
+}

package/dist/template-resolver/template-validation.js

@@ -1,6 +1,6 @@
 import * as z from "zod";
-import { withParsedDocument } from "./document-sanitizer.js";
-import { isDocumentPlaceholderHref, isDocumentReferenceName } from "./document-schema.js";
+import { conditionScopeElement, withParsedDocument } from "./document-sanitizer.js";
+import { DOCUMENT_CONDITION_ATTRIBUTE, isDocumentPlaceholderHref, isDocumentReferenceName, } from "./document-schema.js";
 export const SYSTEM_PLACEHOLDERS = new Set([
     "tenantName",
     "signature",
@@ -34,6 +34,7 @@ const scalarVariableSchema = z.discriminatedUnion("type", [
             .optional(),
     }),
     z.object({ ...variableCommon, type: z.literal("date"), example: textLikeExample }),
+    z.object({ ...variableCommon, type: z.literal("percent"), example: z.number().optional() }),
 ]);
 const variableDefSchema = z.union([
     scalarVariableSchema,
@@ -99,34 +100,47 @@ const NAME_ATTRIBUTE_BY_TAG = {
     span: "data-variable",
     div: "data-steps",
 };
-function scanBodyPlaceholders(body, scope) {
-    withParsedDocument(body, (root) => {
-        for (const element of Array.from(root.querySelectorAll("tr[data-each]"))) {
-            const listName = element.getAttribute("data-each") ?? "";
-            const def = Object.hasOwn(scope.variables, listName) ? scope.variables[listName] : undefined;
-            if (def?.type === "list")
-                scope.used.add(listName);
-            else
-                scope.unknown.add(listName);
+function scanRepeatRows(root, scope) {
+    for (const element of Array.from(root.querySelectorAll("tr[data-each]"))) {
+        const listName = element.getAttribute("data-each") ?? "";
+        const def = Object.hasOwn(scope.variables, listName) ? scope.variables[listName] : undefined;
+        if (def?.type === "list")
+            scope.used.add(listName);
+        else
+            scope.unknown.add(listName);
+    }
+}
+function scanConditions(root, scope) {
+    for (const element of Array.from(root.querySelectorAll(`[${DOCUMENT_CONDITION_ATTRIBUTE}]`))) {
+        const itemFields = listItemFields(scope.variables, enclosingEachName(conditionScopeElement(element)));
+        recordName(element.getAttribute(DOCUMENT_CONDITION_ATTRIBUTE) ?? "", itemFields, scope);
+    }
+}
+function scanReferences(root, scope) {
+    for (const element of Array.from(root.querySelectorAll("span[data-variable], div[data-steps], a[href], img[data-resource]"))) {
+        const itemFields = listItemFields(scope.variables, enclosingEachName(element));
+        const tag = element.tagName.toLowerCase();
+        const nameAttribute = NAME_ATTRIBUTE_BY_TAG[tag];
+        if (nameAttribute !== undefined) {
+            recordName(element.getAttribute(nameAttribute) ?? "", itemFields, scope);
+        }
+        else if (tag === "a") {
+            const href = element.getAttribute("href") ?? "";
+            if (isDocumentPlaceholderHref(href))
+                recordName(href.slice(2, -2), itemFields, scope);
         }
-        for (const element of Array.from(root.querySelectorAll("span[data-variable], div[data-steps], a[href], img[data-resource]"))) {
-            const itemFields = listItemFields(scope.variables, enclosingEachName(element));
-            const tag = element.tagName.toLowerCase();
-            const nameAttribute = NAME_ATTRIBUTE_BY_TAG[tag];
-            if (nameAttribute !== undefined) {
-                recordName(element.getAttribute(nameAttribute) ?? "", itemFields, scope);
-            }
-            else if (tag === "a") {
-                const href = element.getAttribute("href") ?? "";
-                if (isDocumentPlaceholderHref(href))
-                    recordName(href.slice(2, -2), itemFields, scope);
-            }
-            else {
-                const key = element.getAttribute("data-resource") ?? "";
-                if (!scope.resourceKeys.has(key))
-                    scope.unknownResources.add(key);
-            }
+        else {
+            const key = element.getAttribute("data-resource") ?? "";
+            if (!scope.resourceKeys.has(key))
+                scope.unknownResources.add(key);
         }
+    }
+}
+function scanBodyPlaceholders(body, scope) {
+    withParsedDocument(body, (root) => {
+        scanRepeatRows(root, scope);
+        scanConditions(root, scope);
+        scanReferences(root, scope);
     });
 }
 const HANDLEBARS_EXPRESSION = /\{\{([^{}]*)\}\}/g;

package/dist/template-resolver/testing.js

@@ -1,7 +1,7 @@
 // Test-only helpers for template-resolver consumers. Import via
 // `@cosmicdrift/kumiko-bundled-features/template-resolver/testing`.
 // No bun:test here — callers register cases with their own test runner.
-import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
+import { seedRow } from "@cosmicdrift/kumiko-testing/helpers";
 import { TemplateNotFoundError } from "./api.js";
 import { FALLBACK_LOCALE, SYSTEM_TENANT_ID, } from "./constants.js";
 import { templateResourcesTable } from "./table.js";

package/dist/template-resolver/web/i18n.js

@@ -76,6 +76,7 @@ export const defaultTranslations = {
         "templateResolver.errors.collection.kindNotAllowed": "“{detail}” templates are written through their own editor, not through a collection.",
         "templateResolver.errors.noSystemTemplate": "There is no active system template to reset to.",
         "templateResolver.errors.noDraft": "There is no draft to discard.",
+        "templateResolver.errors.systemOnlyTemplate": "Only the platform maintains this template; it cannot be overridden per tenant.",
         "templateResolver.errors.template.invalidMeta": "The template settings are invalid.",
         "templateResolver.errors.template.meta.subject.required": "The subject is missing.",
         "templateResolver.errors.template.meta.subject.invalid": "The subject is invalid (at most 200 characters, no line breaks).",

package/dist/template-resolver-user-data/index.d.ts

@@ -1,3 +1,7 @@
+export declare function createTemplateResolverUserDataFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: void;
+};
+/** @deprecated Use createTemplateResolverUserDataFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const templateResolverUserDataFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };

package/dist/template-resolver-user-data/index.js

@@ -6,16 +6,20 @@
 // notes-history-user-data.
 import { defineFeature, EXT_USER_DATA } from "@cosmicdrift/kumiko-framework/engine";
 import { userContentDeleteHook, userContentExportHook } from "./hooks.js";
-export const templateResolverUserDataFeature = defineFeature("template-resolver-user-data", (r) => {
-    r.describe("GDPR (Art. 20 export / Art. 17 erasure) coverage for the `template-resolver` feature's `user-content-entry` entity — the per-user half of the content store (mail signatures, personal reply snippets). Mounts the EXT_USER_DATA export hook so a user's own entries land in the export bundle; the delete hook is a deliberate no-op because `content` is annotated `userOwned`, so erasure runs via crypto-shredding (destroying the owner's subject key) rather than a physical delete, which would not survive an event replay. Mount this whenever `createTemplateResolverFeature` declares a collection with `ownership: \"user\"` — the boot guard otherwise refuses the entity. Requires `user-data-rights`, optionalRequires `template-resolver`.");
-    // user-data-rights is the hard dependency (EXT_USER_DATA host).
-    // template-resolver is optional for the same reason as in
-    // notes-history-user-data: a toggleable mount would otherwise trip the
-    // "effectively disabled" boot warning even though the entity is there.
-    r.requires({ features: ["user-data-rights"] });
-    r.optionalRequires("template-resolver");
-    r.useExtension(EXT_USER_DATA, "user-content-entry", {
-        export: userContentExportHook,
-        delete: userContentDeleteHook,
-    });
-});
+export function createTemplateResolverUserDataFeature() {
+    return defineFeature("template-resolver-user-data", (r) => {
+        r.describe("GDPR (Art. 20 export / Art. 17 erasure) coverage for the `template-resolver` feature's `user-content-entry` entity — the per-user half of the content store (mail signatures, personal reply snippets). Mounts the EXT_USER_DATA export hook so a user's own entries land in the export bundle; the delete hook is a deliberate no-op because `content` is annotated `userOwned`, so erasure runs via crypto-shredding (destroying the owner's subject key) rather than a physical delete, which would not survive an event replay. Mount this whenever `createTemplateResolverFeature` declares a collection with `ownership: \"user\"` — the boot guard otherwise refuses the entity. Requires `user-data-rights`, optionalRequires `template-resolver`.");
+        // user-data-rights is the hard dependency (EXT_USER_DATA host).
+        // template-resolver is optional for the same reason as in
+        // notes-history-user-data: a toggleable mount would otherwise trip the
+        // "effectively disabled" boot warning even though the entity is there.
+        r.requires({ features: ["user-data-rights"] });
+        r.optionalRequires("template-resolver");
+        r.useExtension(EXT_USER_DATA, "user-content-entry", {
+            export: userContentExportHook,
+            delete: userContentDeleteHook,
+        });
+    }, { dedupeOptions: {} });
+}
+/** @deprecated Use createTemplateResolverUserDataFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const templateResolverUserDataFeature = createTemplateResolverUserDataFeature();

package/dist/tenant/handlers/active-tenant-ids.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, SYSTEM_ROLE, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/dist/tenant/handlers/add-member.write.js

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, SYSTEM_ROLE, SYSTEM_USER_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, ConflictError, InternalError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/dist/tenant/handlers/cancel-invitation.write.js

@@ -9,7 +9,7 @@
 // Idempotent: cancelling an already-cancelled / accepted / expired
 // invitation = no-op + 200. Cancelling a non-existent invitation
 // = invitation_not_found.
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/dist/tenant/handlers/invitations.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/dist/tenant/handlers/me.query.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/dist/tenant/handlers/member-directory.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, definePagedQueryHandler, MAX_LIST_LIMIT, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/dist/tenant/handlers/members.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";

package/dist/tenant/handlers/memberships.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, SYSTEM_ROLE } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";

package/dist/tenant/handlers/remove-member.write.js

@@ -1,5 +1,4 @@
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, fetchOne, selectMany, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, defineWriteHandler, parseTenantId, withResponseData, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";

package/dist/tenant/handlers/resolve-user-ids.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, SYSTEM_ROLE } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/dist/tenant/handlers/team-list.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, definePagedQueryHandler, MAX_LIST_LIMIT, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";

package/dist/tenant/handlers/tenant-directory.query.js

@@ -1,4 +1,4 @@
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, definePagedQueryHandler, MAX_LIST_LIMIT, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/dist/tenant/handlers/update-member-roles.write.js

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { access, assignableAppRolesOf, createSystemUser, defineWriteHandler, findForbiddenRoleAssignment, mayOverrideTenant, mergeAssignedRoles, parseTenantId, SYSTEM_ROLE, withResponseData, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, ValidationError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";

package/dist/tenant/invited-membership.js

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb, fetchOne, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser } from "@cosmicdrift/kumiko-framework/engine";
 import { ConflictError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
@@ -44,7 +43,7 @@ export async function grantInvitedMembershipRole(db, options) {
     if (currentRoles.includes(options.role))
         return grantedMembership(true, currentRoles);
     const roles = [...currentRoles, options.role];
-    const updateResult = await membershipExecutor.update({ id: existing.id, version: existing.version, changes: { roles: JSON.stringify(roles) } }, createSystemUser(options.tenantId), createTenantDb(db, options.tenantId, "system"));
+    const updateResult = await membershipExecutor.update({ id: existing.id, version: existing.version, changes: { roles: JSON.stringify(roles) } }, createSystemUser(options.tenantId), createTenantDb({ db, tenantId: options.tenantId, mode: "system" }));
     if (!updateResult.isSuccess)
         return updateResult;
     return grantedMembership(true, roles);

package/dist/tenant/last-tenant-admin.js

@@ -1,5 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { acquireNamespacedAdvisoryLock } from "@cosmicdrift/kumiko-framework/db";
+import { acquireNamespacedAdvisoryLock, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { ConflictError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { TenantErrors } from "./constants.js";

package/dist/tenant/seeding.js

@@ -27,12 +27,11 @@
 // Idempotent (add-only): calling twice for the same (userId, tenantId) is
 // a no-op on the second call. Memberships have no update-semantic — to
 // change roles, write a new event via the regular handler path.
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb, fetchOne, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, HookPhases, } from "@cosmicdrift/kumiko-framework/engine";
 import { getUnscopedAggregateStreamMaxVersion } from "@cosmicdrift/kumiko-framework/event-store";
 import { createDeferringNotify, createLifecycleHooks, } from "@cosmicdrift/kumiko-framework/pipeline";
-import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
+import { TestUsers } from "@cosmicdrift/kumiko-framework/seeding";
 import { assertAssignableMembershipRoles } from "./membership-roles.js";
 import { tenantMembershipEntity, tenantMembershipsTable } from "./membership-table.js";
 import { tenantEntity, tenantTable } from "./schema/tenant.js";
@@ -87,7 +86,14 @@ function scopeSeedHookContext(context, targetTenantId, runner,
 // The afterCommit sink is snapshotted when it flushes, so a hook scheduled from inside an
 // afterCommit-phase hook would be dropped: that phase must notify inline.
 notifyTiming) {
-    const db = createTenantDb(runner, targetTenantId, "system", context.tracer, context.meter, context.signal);
+    const db = createTenantDb({
+        db: runner,
+        tenantId: targetTenantId,
+        mode: "system",
+        tracer: context.tracer,
+        meter: context.meter,
+        signal: context.signal,
+    });
     // HandlerContext carries `user`; AppContext only `systemUser`. Prefer the
     // live handler user when present so notify/hasFeature keep a real SessionUser.
     const handlerUser = context.user;
@@ -160,7 +166,7 @@ export async function seedTenant(db, options, hooks) {
     // tenant-scoped ist, braucht der Wrap-Layer für die runtime-API zu
     // existieren. by.tenantId reicht — keine Override-Semantik wie bei
     // seedTenantMembership nötig.
-    const tdb = createTenantDb(db, by.tenantId, "system");
+    const tdb = createTenantDb({ db, tenantId: by.tenantId, mode: "system" });
     const existing = await fetchOne(db, tenantTable, { id: options.id });
     if (existing)
         return { id: options.id };
@@ -211,7 +217,7 @@ hooks) {
     const by = options.by ?? createSystemUser(options.tenantId);
     // System-scoped TenantDb: payload.tenantId may differ from an explicit
     // `by` override; stream tenant still follows `by` via streamTenantFor.
-    const tdb = createTenantDb(db, options.tenantId, "system");
+    const tdb = createTenantDb({ db, tenantId: options.tenantId, mode: "system" });
     // Idempotency: duplicate seeds are common across beforeEach-resets where
     // only certain tables get truncated. A plain executor.create would trip
     // the (user_id, tenant_id) unique index; the fixture call-site would then

package/dist/tenant-lifecycle/handlers/cancel-destruction.write.js

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/dist/tenant-lifecycle/handlers/request-destruction.write.js

@@ -1,6 +1,5 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { addDurationSpec } from "@cosmicdrift/kumiko-framework/compliance";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";

package/dist/tenant-lifecycle/lib/revoke-tenant-sessions.js

@@ -1,4 +1,4 @@
-import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { updateMany } from "@cosmicdrift/kumiko-framework/db";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { userSessionTable } from "../../sessions/index.js";
 /** Revoke all live sessions scoped to a tenant (destruction-request gate). */

package/dist/tenant-lifecycle/lifecycle-gate.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { tenantTable } from "../tenant/index.js";
 // Every authenticated + anonymous request consults this (via auth-middleware's
 // resolveTenantLifecycleStatus) — a per-request DB round-trip otherwise.

package/dist/tenant-lifecycle/run-tenant-destroy.js

@@ -1,6 +1,4 @@
-/// <reference types="temporal-polyfill/global" preserve="true" />
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, createTenantDb, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb, selectMany, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { append, loadAggregate, VersionConflictError, } from "@cosmicdrift/kumiko-framework/event-store";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
@@ -91,7 +89,7 @@ async function appendTenantStageEventIdempotent(db, tenantId, type, payload, exp
 }
 async function markTenantDestroyFailed(db, tenantId) {
     const user = createSystemUser(tenantId);
-    const scopedDb = createTenantDb(db, tenantId, "system");
+    const scopedDb = createTenantDb({ db, tenantId, mode: "system" });
     await tenantCrud.update({
         id: tenantId,
         changes: { status: "destroyFailed" },
@@ -234,7 +232,7 @@ export async function runTenantDestructionSweep(args) {
         const events = await loadAggregate(args.db, tenantId, tenantId);
         const version = lastEventVersion(events);
         const user = createSystemUser(tenantId);
-        const scopedDb = createTenantDb(args.db, tenantId, "system");
+        const scopedDb = createTenantDb({ db: args.db, tenantId, mode: "system" });
         // Version-guarded (no skipOptimisticLock): a concurrent cancel-destruction
         // between the `due` select above and this write also appends to the same
         // tenant stream, so an unguarded overwrite here would silently revert the

package/dist/tenant-lifecycle/stages.js

@@ -1,6 +1,5 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
-import { createEventStoreExecutor, createTenantDb, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb, selectMany, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, EXT_EXTERNAL_RESOURCE, EXT_INFRA_RESOURCE, EXT_SEARCH_ADAPTER, EXT_STORAGE_PROVIDER, EXT_TENANT_DATA, extensionUsageEscapeHatchReason, isTenantDataExtensionHooks, isTenantResourceExtensionHooks, } from "@cosmicdrift/kumiko-framework/engine";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { createEscapeHatchReporter, UNATTRIBUTED_ACTOR, } from "@cosmicdrift/kumiko-framework/pipeline";
@@ -56,9 +55,14 @@ async function runTenantDataHooks(ctx) {
             log: ctx.escapeHatchAuditLog ?? createFallbackLogger("tenant-lifecycle"),
         });
         const hookCtx = {
-            db: createTenantDb(ctx.db, ctx.tenantId, "tenant", undefined, undefined, undefined, {
-                unsafeRaw: reason !== undefined ? { reason } : undefined,
-                report,
+            db: createTenantDb({
+                db: ctx.db,
+                tenantId: ctx.tenantId,
+                mode: "tenant",
+                grants: {
+                    unsafeRaw: reason !== undefined ? { reason } : undefined,
+                    report,
+                },
             }),
             registry: ctx.registry,
             tenantId: ctx.tenantId,
@@ -106,7 +110,7 @@ async function purgeTenantCache(ctx) {
 async function tombstoneTenantRow(ctx) {
     const now = getTemporal().Now.instant();
     const user = createSystemUser(ctx.tenantId);
-    const db = createTenantDb(ctx.db, ctx.tenantId, "system");
+    const db = createTenantDb({ db: ctx.db, tenantId: ctx.tenantId, mode: "system" });
     // Per-row forget() through the executor, not a bulk deleteMany: memberships
     // are an ES-managed projection (add/remove/update-roles all go through
     // tenantMembershipCrud), so a store table write here is eventless — a future

package/dist/tenant-lifecycle/testing.d.ts

@@ -1,7 +1,7 @@
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { SearchAdapter } from "@cosmicdrift/kumiko-framework/search";
-import type { TestStack } from "@cosmicdrift/kumiko-framework/stack";
+import type { TestStack } from "@cosmicdrift/kumiko-testing/stack";
 import { runTenantDestructionSweep } from "./run-tenant-destroy.js";
 export declare function seedDestroyingTenant(db: DbConnection, tenantId: TenantId): Promise<void>;
 export declare function driveDestructionToCompletion(stack: TestStack, db: DbConnection, tenantId: TenantId, searchAdapter?: SearchAdapter): Promise<string>;

package/dist/tenant-lifecycle/testing.js

@@ -1,7 +1,7 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { append, loadAggregate } from "@cosmicdrift/kumiko-framework/event-store";
-import { updateRows } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import { updateRows } from "@cosmicdrift/kumiko-testing/helpers";
 import { tenantTable } from "../tenant/index.js";
 import { TENANT_AGGREGATE_TYPE, TENANT_DESTRUCTION_STARTED_EVENT_QN } from "./constants.js";
 import { runTenantDestructionSweep } from "./run-tenant-destroy.js";

package/dist/tenant-settings/feature.d.ts

@@ -2,4 +2,5 @@ import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { type TenantSettingsKeyOptions } from "./config.js";
 export type TenantSettingsFeatureOptions = TenantSettingsKeyOptions;
 export declare function createTenantSettingsFeature(opts?: TenantSettingsFeatureOptions): FeatureDefinition;
+/** @deprecated Use createTenantSettingsFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const tenantSettingsFeature: FeatureDefinition;