@cosmicdrift/kumiko-bundled-features 0.366.0 → 0.368.0

package/dist/user-data-rights/lib/deny-if-target-outside-admin-tenant.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { AccessDeniedError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { tenantMembershipsTable } from "../../tenant/index.js";
 import { isSystemAdminActor } from "./is-admin-actor.js";

package/dist/user-data-rights/lib/update-user-lifecycle.d.ts

@@ -3,6 +3,7 @@ import { type WritePurpose } from "@cosmicdrift/kumiko-framework/db";
 export type UpdateUserLifecycleOptions = {
     readonly expect?: Readonly<Record<string, string | number | boolean | null>>;
     readonly writePurpose?: WritePurpose;
+    readonly includeDeleted?: boolean;
 };
 export declare function updateUserLifecycle(conn: DbRunner, userId: string, changes: Record<string, unknown>, options?: UpdateUserLifecycleOptions): Promise<{
     readonly applied: boolean;

package/dist/user-data-rights/lib/update-user-lifecycle.js

@@ -1,5 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb, selectMany, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { USER_STATUS, userEntity, userTable } from "../../user/index.js";
@@ -38,11 +37,12 @@ export async function updateUserLifecycle(conn, userId, changes, options) {
     // (restrict/lift-restriction/grace-period/cancel/forget) that holds no row
     // version to pass as `payload.version`, which update() requires otherwise.
     // Callers needing a guard use `options.expect` instead.
-    const tenantDb = createTenantDb(conn, SYSTEM_TENANT_ID, "system");
+    const tenantDb = createTenantDb({ db: conn, tenantId: SYSTEM_TENANT_ID, mode: "system" });
     const result = await userExecutor.update({ id: userId, changes }, createSystemUser(SYSTEM_TENANT_ID), tenantDb, {
         skipOptimisticLock: true,
         ...(options?.expect && { expect: options.expect }),
         ...(options?.writePurpose && { writePurpose: options.writePurpose }),
+        ...(options?.includeDeleted && { includeDeleted: true }),
     });
     if (result.isSuccess)
         return { applied: true };

package/dist/user-data-rights/run-export-jobs.js

@@ -43,10 +43,9 @@
 // **Storage-Cleanup:** dritter Pass loescht abgelaufene downloadStorageKeys
 // (`expiresAt + exportStorageCleanupGraceHours < now`) — abgelaufene ZIPs
 // auf S3 sollen nicht ewig liegen.
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { addDurationSpec } from "@cosmicdrift/kumiko-framework/compliance";
 import { PII_ERASED_SENTINEL } from "@cosmicdrift/kumiko-framework/crypto";
-import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb, fetchOne, selectMany, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser } from "@cosmicdrift/kumiko-framework/engine";
 import { createZipStream, tenantExportPrefix, } from "@cosmicdrift/kumiko-framework/files";
 import { resolveProfileForTenant } from "../compliance-profiles/index.js";
@@ -547,7 +546,7 @@ function reportCleanupLastRun(metrics, now) {
 // Stream-Counter konsistent bleibt (Memory feedback_event_store_tenant_consistency).
 // @wrapper-known semantic-alias
 function systemTenantDb(db, tenantId) {
-    return createTenantDb(db, tenantId, "system");
+    return createTenantDb({ db, tenantId, mode: "system" });
 }
 function buildExportStorageKey(job) {
     return `${tenantExportPrefix(job.requestedFromTenantId)}${job.id}.zip`;

package/dist/user-data-rights/run-forget-cleanup.js

@@ -34,9 +34,8 @@ import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 // gesammelt + zurueckgegeben fuer Operator-Visibility. Ein User mit
 // gefailten Hooks bleibt im DeletionRequested-Status (next Lauf
 // retried automatisch).
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
-import { createTenantDb, entityEventName, executeRawQuery, nullBlindIndexesForSubject, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
+import { createTenantDb, entityEventName, executeRawQuery, fetchOne, nullBlindIndexesForSubject, selectMany, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
 import { EXT_USER_DATA, EXT_USER_DATA_ORDER, extensionUsageEscapeHatchReason, } from "@cosmicdrift/kumiko-framework/engine";
 import { createEscapeHatchReporter, UNATTRIBUTED_ACTOR, } from "@cosmicdrift/kumiko-framework/pipeline";
 import { purgeSearchDocumentsForSubject, } from "@cosmicdrift/kumiko-framework/search";
@@ -54,9 +53,14 @@ function buildHookDb(db, tenantId, entry, args) {
         sink: args.escapeHatchAuditSink,
         log: args.escapeHatchAuditLog ?? createFallbackLogger("user-data-rights"),
     });
-    return createTenantDb(db, tenantId, "tenant", undefined, undefined, undefined, {
-        unsafeRaw: entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
-        report,
+    return createTenantDb({
+        db,
+        tenantId,
+        mode: "tenant",
+        grants: {
+            unsafeRaw: entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
+            report,
+        },
     });
 }
 // EXT_USER_DATA delete-hooks default here; a hook that redacts data keyed on an

package/dist/user-data-rights/run-user-export.js

@@ -20,9 +20,8 @@ import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 // **PII-Surface:** Hooks definieren selbst welche Felder ins Bundle
 // landen. user-data-rights-defaults/hooks/user.userdata-hook expose
 // expliziert KEIN passwordHash + KEINE roles (privileged columns).
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, } from "@cosmicdrift/kumiko-framework/crypto";
-import { collectEncryptedFieldNames, configuredEntityFieldEncryption, createTenantDb, decryptEntityFieldValues, } from "@cosmicdrift/kumiko-framework/db";
+import { collectEncryptedFieldNames, configuredEntityFieldEncryption, createTenantDb, decryptEntityFieldValues, selectMany, } from "@cosmicdrift/kumiko-framework/db";
 import { EXT_USER_DATA, extensionUsageEscapeHatchReason, maskWriteOnlyFields, } from "@cosmicdrift/kumiko-framework/engine";
 import { createEscapeHatchReporter, UNATTRIBUTED_ACTOR, } from "@cosmicdrift/kumiko-framework/pipeline";
 import { tenantMembershipsTable } from "../tenant/index.js";
@@ -35,9 +34,14 @@ function buildHookDb(db, tenantId, entry, args) {
         sink: args.escapeHatchAuditSink,
         log: args.escapeHatchAuditLog ?? createFallbackLogger("user-data-rights"),
     });
-    return createTenantDb(db, tenantId, "tenant", undefined, undefined, undefined, {
-        unsafeRaw: entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
-        report,
+    return createTenantDb({
+        db,
+        tenantId,
+        mode: "tenant",
+        grants: {
+            unsafeRaw: entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
+            report,
+        },
     });
 }
 /**

package/dist/waitlist/handlers/invite.write.js

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { acquireNamespacedAdvisoryLock } from "@cosmicdrift/kumiko-framework/db";
+import { acquireNamespacedAdvisoryLock, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, defineWriteHandler, parseTenantId, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";

package/dist/waitlist/handlers/reject.write.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, defineWriteHandler, parseTenantId, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { cancelPendingInvitation, INVITATION_STATUS, tenantInvitationsTable, } from "../../tenant/index.js";

package/dist/waitlist/lib.js

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, fetchOne, } from "@cosmicdrift/kumiko-framework/db";
 import { access, createSystemUser, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { tenantMembershipsTable } from "../tenant/index.js";

package/dist/workflow-runner/event-subscriber.js

@@ -23,7 +23,7 @@
 // + triggerEventRef + wakeAt=now() onto the matching pending row(s); the
 // existing resume-due-runs job (Phase 2) picks the row up on its next
 // cron tick — the one resume path stays exactly the one Phase 2 built.
-import { selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany, updateMany } from "@cosmicdrift/kumiko-framework/db";
 import { evaluateEventMatch } from "@cosmicdrift/kumiko-framework/engine";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";

package/dist/workflow-runner/feature.d.ts

@@ -1,3 +1,7 @@
+export declare function createWorkflowRunnerFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: void;
+};
+/** @deprecated Use createWorkflowRunnerFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const workflowRunnerFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };

package/dist/workflow-runner/feature.js

@@ -32,45 +32,49 @@ import { workflowRunPendingTableMeta } from "./tables.js";
 // bundled feature's runtime name follows this convention, and
 // use-all-bundled's check-coverage matches exports to mounted features by it.
 const FEATURE_NAME = "workflow-runner";
-export const workflowRunnerFeature = defineFeature(FEATURE_NAME, (r) => {
-    r.describe("Writes the run-envelope (`workflow.run-started` / `workflow.run-completed` / `workflow.run-failed`) for a workflow run onto its `workflow-run` aggregate stream. Provides `startAndRunWorkflow` and `registerEventTrigger` for consumer features to wire up `defineWorkflow`-based workflows against domain events. Registers no workflows itself. Runs the resume loop for suspended `wait`/`retry`/`waitForEvent` steps (`resume-due-runs` job + `resume-run` handler); `registerEventTrigger` wires an event-wakeup subscriber per workflow that declares `awaits` so a `waitForEvent` step resumes as soon as its awaited event arrives, not just on timeout.");
-    r.uiHints({
-        displayLabel: "Workflow Runner",
-        category: "infrastructure",
-        recommended: false,
-    });
-    // resume-run needs a full HandlerContext + ctx.systemDb (the pending-row
-    // scan crosses whatever tenant the row belongs to relative to the job's
-    // own tenant loop iteration) — same reasoning as tenant/feature.ts.
-    r.systemScope();
-    r.storeTable(workflowRunPendingTableMeta, {
-        reason: "resume_loop.pending_suspended_steps",
-    });
-    registerWorkflowRunPendingProjection(r);
-    r.writeHandler(resumeRunHandler);
-    r.job("resume-due-runs", { trigger: { cron: "* * * * *" }, perTenant: true, concurrency: "skip" }, async (_payload, ctx) => {
-        if (!ctx.systemDb) {
-            throw new Error("resume-due-runs: ctx.systemDb required (r.systemScope() feature)");
-        }
-        const tenantId = ctx.systemUser?.tenantId ?? ctx._tenantId;
-        if (tenantId === undefined) {
-            // skip: cron fired without a perTenant fan-out tenant — nothing scoped
-            return;
-        }
-        const dueRows = await selectDueWorkflowRunPending(ctx.systemDb.assertTenantMatch(tenantId));
-        for (const row of dueRows) {
-            try {
-                await ctx.write("workflow-runner:write:resume-run", {
-                    runId: row.runId,
-                    stepIndex: row.stepIndex,
-                });
+export function createWorkflowRunnerFeature() {
+    return defineFeature(FEATURE_NAME, (r) => {
+        r.describe("Writes the run-envelope (`workflow.run-started` / `workflow.run-completed` / `workflow.run-failed`) for a workflow run onto its `workflow-run` aggregate stream. Provides `startAndRunWorkflow` and `registerEventTrigger` for consumer features to wire up `defineWorkflow`-based workflows against domain events. Registers no workflows itself. Runs the resume loop for suspended `wait`/`retry`/`waitForEvent` steps (`resume-due-runs` job + `resume-run` handler); `registerEventTrigger` wires an event-wakeup subscriber per workflow that declares `awaits` so a `waitForEvent` step resumes as soon as its awaited event arrives, not just on timeout.");
+        r.uiHints({
+            displayLabel: "Workflow Runner",
+            category: "infrastructure",
+            recommended: false,
+        });
+        // resume-run needs a full HandlerContext + ctx.systemDb (the pending-row
+        // scan crosses whatever tenant the row belongs to relative to the job's
+        // own tenant loop iteration) — same reasoning as tenant/feature.ts.
+        r.systemScope();
+        r.storeTable(workflowRunPendingTableMeta, {
+            reason: "resume_loop.pending_suspended_steps",
+        });
+        registerWorkflowRunPendingProjection(r);
+        r.writeHandler(resumeRunHandler);
+        r.job("resume-due-runs", { trigger: { cron: "* * * * *" }, perTenant: true, concurrency: "skip" }, async (_payload, ctx) => {
+            if (!ctx.systemDb) {
+                throw new Error("resume-due-runs: ctx.systemDb required (r.systemScope() feature)");
             }
-            catch (error) {
-                // skip: one row's dispatch failing (infra hiccup, not a business
-                // outcome — resume-run itself never throws for expected cases)
-                // must not stop the rest of this tenant's due rows from resuming.
-                ctx.log.warn(`[workflow-runner:resume-due-runs] runId=${row.runId} stepIndex=${row.stepIndex} dispatch failed: ${String(error)}`);
+            const tenantId = ctx.systemUser?.tenantId ?? ctx._tenantId;
+            if (tenantId === undefined) {
+                // skip: cron fired without a perTenant fan-out tenant — nothing scoped
+                return;
             }
-        }
-    });
-});
+            const dueRows = await selectDueWorkflowRunPending(ctx.systemDb.assertTenantMatch(tenantId));
+            for (const row of dueRows) {
+                try {
+                    await ctx.write("workflow-runner:write:resume-run", {
+                        runId: row.runId,
+                        stepIndex: row.stepIndex,
+                    });
+                }
+                catch (error) {
+                    // skip: one row's dispatch failing (infra hiccup, not a business
+                    // outcome — resume-run itself never throws for expected cases)
+                    // must not stop the rest of this tenant's due rows from resuming.
+                    ctx.log.warn(`[workflow-runner:resume-due-runs] runId=${row.runId} stepIndex=${row.stepIndex} dispatch failed: ${String(error)}`);
+                }
+            }
+        });
+    }, { dedupeOptions: {} });
+}
+/** @deprecated Use createWorkflowRunnerFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const workflowRunnerFeature = createWorkflowRunnerFeature();

package/dist/workflow-runner/handlers/resume-run.write.js

@@ -29,7 +29,7 @@
 // pipeline's result for the skipped waitForEvent step itself (see
 // resultKey on steps/wait-for-event.ts) — pre-seeded into stepsAcc below so
 // a subsequent step's resolver can read `ctx.steps[awaits.someKey]`.
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { buildPipelineSteps, computeDefinitionFingerprint, describeWorkflowStepError, getStep, runStepList, SYSTEM_ROLE, unwrapWorkflowStepError, WORKFLOW_AGGREGATE_TYPE, WORKFLOW_RESUMED_TYPE, WORKFLOW_RETRY_SCHEDULED_TYPE, WORKFLOW_RUN_COMPLETED_TYPE, WORKFLOW_RUN_FAILED_TYPE, WORKFLOW_RUN_STARTED_TYPE, WORKFLOW_WAITING_FOR_EVENT_TYPE, WorkflowStepError, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";

package/dist/workflow-runner/index.d.ts

@@ -1,4 +1,4 @@
 export { workflowRunAggregateId } from "./aggregate-id.js";
 export { registerEventTrigger } from "./event-trigger.js";
-export { workflowRunnerFeature } from "./feature.js";
+export { createWorkflowRunnerFeature, workflowRunnerFeature } from "./feature.js";
 export { startAndRunWorkflow, type WorkflowRunCompletedPayload, type WorkflowRunFailedPayload, type WorkflowRunStartedPayload, WorkflowSuspensionUnsupportedError, } from "./runner.js";

package/dist/workflow-runner/index.js

@@ -1,5 +1,5 @@
 // Public API of the workflow-runner bundled-feature.
 export { workflowRunAggregateId } from "./aggregate-id.js";
 export { registerEventTrigger } from "./event-trigger.js";
-export { workflowRunnerFeature } from "./feature.js";
+export { createWorkflowRunnerFeature, workflowRunnerFeature } from "./feature.js";
 export { startAndRunWorkflow, WorkflowSuspensionUnsupportedError, } from "./runner.js";

package/dist/workflow-runner/pending-projection.js

@@ -11,7 +11,7 @@
 // No resume logic here — framework#2513 Phase 2 owns the job that reads
 // this table and dispatches the actual resume. This projection only writes
 // the rows.
-import { deleteMany, fetchOne, upsertOnConflict } from "@cosmicdrift/kumiko-framework/bun-db";
+import { deleteMany, fetchOne, upsertOnConflict } from "@cosmicdrift/kumiko-framework/db";
 import { WORKFLOW_RESUMED_TYPE, WORKFLOW_RETRY_SCHEDULED_TYPE, WORKFLOW_RUN_COMPLETED_TYPE, WORKFLOW_RUN_FAILED_TYPE, WORKFLOW_WAITING_FOR_EVENT_TYPE, WORKFLOW_WAITING_TYPE, } from "@cosmicdrift/kumiko-framework/engine";
 import { workflowRunPendingTable } from "./tables.js";
 async function upsertPending(tx, row) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.366.0",
+  "version": "0.368.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -226,6 +226,10 @@
       "types": "./dist/file-provider-s3/index.d.ts",
       "default": "./dist/file-provider-s3/index.js"
     },
+    "./file-provider-s3/lib": {
+      "types": "./dist/file-provider-s3/lib/index.d.ts",
+      "default": "./dist/file-provider-s3/lib/index.js"
+    },
     "./document-ingest-foundation": {
       "types": "./dist/document-ingest-foundation/index.d.ts",
       "default": "./dist/document-ingest-foundation/index.js"
@@ -524,12 +528,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.366.0",
-    "@cosmicdrift/kumiko-framework": "0.366.0",
-    "@cosmicdrift/kumiko-headless": "0.366.0",
-    "@cosmicdrift/kumiko-renderer": "0.366.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.366.0",
-    "@cosmicdrift/kumiko-types": "0.366.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.368.0",
+    "@cosmicdrift/kumiko-framework": "0.368.0",
+    "@cosmicdrift/kumiko-headless": "0.368.0",
+    "@cosmicdrift/kumiko-renderer": "0.368.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.368.0",
+    "@cosmicdrift/kumiko-types": "0.368.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@tiptap/core": "3.31.3",
@@ -772,6 +776,10 @@
         "types": "./dist/file-provider-s3/index.d.ts",
         "default": "./dist/file-provider-s3/index.js"
       },
+      "./file-provider-s3/lib": {
+        "types": "./dist/file-provider-s3/lib/index.d.ts",
+        "default": "./dist/file-provider-s3/lib/index.js"
+      },
       "./document-ingest-foundation": {
         "types": "./dist/document-ingest-foundation/index.d.ts",
         "default": "./dist/document-ingest-foundation/index.js"
@@ -1078,10 +1086,19 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.366.0",
-    "@cosmicdrift/kumiko-locale-es": "0.366.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.366.0",
+    "@cosmicdrift/kumiko-locale-de": "0.368.0",
+    "@cosmicdrift/kumiko-locale-es": "0.368.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.368.0",
     "jsqr": "^1.4.0",
-    "unpdf": "^1.8.1"
+    "unpdf": "^1.8.1",
+    "@cosmicdrift/kumiko-testing": "0.368.0"
+  },
+  "peerDependencies": {
+    "@cosmicdrift/kumiko-testing": ">=0.366.0 <1.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@cosmicdrift/kumiko-testing": {
+      "optional": true
+    }
   }
 }

package/src/cap-counter/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.368.0",
+    "type": "improvement",
+    "title": "calendarCapReservationHandle consumes a reservation per unit",
+    "detail": "`reserveCalendarCapUsage` now returns `reservationId`. `calendarCapReservationHandle(ctx, reservationId, { capName, periodStartIso })` returns a handle with `consume(units)` (turns reserved units into booked ones, counter unchanged) and `release()` (gives back the unconsumed rest). A handler reserves the worst case before the job is dispatched, the job consumes per written unit, so parallel dispatches can no longer overshoot the hard cap and a retry only counts what was written.\n\n`consume` beyond the still-reserved rest throws `CapReservationOverConsumedError` (422, `cap_reservation_over_consumed`). `consume` against a settle tombstone throws `CapReservationSettledError` (422, `cap_reservation_settled`); `release` against it is a no-op. When the reservation outlived its TTL and was swept, `consume` books the units directly, the way settle does for a missing row, without a hard-cap check."
+  },
+  {
+    "version": "0.368.0",
+    "type": "fix",
+    "title": "Swept or released calendar reservations remember the units consume booked",
+    "detail": "The reservation row now stores `consumed_amount`. A release or the TTL sweep gives back only the unconsumed rest. If units were consumed, it keeps the row as a released tombstone (`released_at` set, `amount` 0) until the tombstone TTL passes, instead of deleting it. A later `settle` subtracts the consumed units from the booking, and a `consume` after the sweep books its units directly and is remembered the same way, so the counter ends at exactly the settled total. `settle` below the consumed units throws `CapSettleBelowConsumedError` (422, `cap_settle_below_consumed`) in every state. Expired released tombstones are deleted by the sweep.",
+    "migration": "Apps with cap-counter generate a migration for the new columns store_cap_reservations.consumed_amount (integer NOT NULL DEFAULT 0) and store_cap_reservations.released_at (kumiko migrate generate)."
+  },
   {
     "version": "0.366.0",
     "type": "fix",

package/src/channel-email/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.367.0",
+    "type": "improvement",
+    "title": "Email channel can send through the tenant's own mail provider",
+    "detail": "EmailChannelOptions gets tenantTransport, a resolver called per send with the delivery channel context. mail-foundation exports tenantMailTransport for it: a tenant with a provider configured sends through its own transport, a broken provider fails the send, a tenant without a provider uses the app transport. The transport is built per send and never cached, and the tenant comes from the server-side delivery context only. ChannelContext now carries the tenant's config accessor as config. Without tenantTransport nothing changes."
+  },
   {
     "version": "0.365.0",
     "type": "fix",

package/src/crypto-shredding/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.368.0",
+    "type": "fix",
+    "title": "forget-subject closes the login door for users whose stream is already deleted",
+    "detail": "forget-subject returned 500 (\"user lifecycle update failed ... not_found\") when the user stream was deleted but the read_users status still read active, leaving sessions and PATs alive. The erasure now appends the status-deleted user.updated event to that stream too, so the login door closes, the handler returns 200 and a read_users rebuild keeps the state."
+  },
   {
     "version": "0.366.0",
     "type": "fix",

package/src/delivery/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.367.0",
+    "type": "improvement",
+    "title": "Delivery signs unsubscribe links itself",
+    "detail": "r.notification(name, { unsubscribe: true }) makes delivery put a signed data.unsubscribeUrl into every email of that notification when the service has unsubscribeLinks. User recipients get a user token, route recipients an address token (only with a blind-index key, otherwise no link). The token is scoped to tenant, notification and channel; a link the caller passes in data.unsubscribeUrl wins. runProdApp option unsubscribe: { secret } mounts createUnsubscribeRoutes and wires the links; the base URL comes from auth.publicOrigin, auth.mail.baseUrl or APP_BASE_URL, and without one boot warns and no link is added."
+  },
+  {
+    "version": "0.367.0",
+    "type": "improvement",
+    "title": "Unsubscribe links use the tenant's host and the mail's language, apps learn about address opt-outs",
+    "detail": "unsubscribeLinks and the runProdApp option unsubscribe take tenantOrigin, an app callback that returns the sending tenant's own origin (subdomain or custom domain) per send; null, a throw or a non-https value fall back to the app origin and never fail the send. The signed token now carries the mail's locale (notify option locale), so the confirmation, result and undo pages render in that language; tokens without it keep working and show English. A form post to the resubscribe route now answers with an HTML page, JSON callers are unchanged. After a committed address opt-out an app job declared with trigger on DeliveryHandlers.unsubscribeAddress receives addressHash, notificationType and channel (unsubscribeAddressPayloadSchema) with the tenant in ctx.triggeredBy.tenantId; hashUnsubscribeAddress(email) matches it to the app's own subscriber. UNSUBSCRIBE_PAGE_EN exports the English page texts, German and Spanish come with the locale packages."
+  },
   {
     "version": "0.366.0",
     "type": "improvement",

package/src/file-provider-s3/changes.json

@@ -1 +1,10 @@
-[]
+[
+  {
+    "version": "0.368.0",
+    "type": "breaking",
+    "title": "The S3 file providers merge into createFileProviderS3Feature({ fromEnv })",
+    "detail": "createFileProviderS3Feature() mounts the per-tenant config provider as before. createFileProviderS3Feature({ fromEnv: true }) mounts the env-configured provider (feature name, provider key \"s3-env\" and requires unchanged). The S3 client helpers (createS3Provider, createS3ProviderFromEnv, parseS3EnvConfig, resolveForcePathStyle, S3ProviderConfig) move to the new subpath @cosmicdrift/kumiko-bundled-features/file-provider-s3/lib.\n\nThe subpaths file-provider-s3-env and files-provider-s3 keep working as deprecated re-exports and are removed in the first release after 2026-10-29.\n\nold -> new:\n  fileProviderS3EnvFeature from .../file-provider-s3-env -> createFileProviderS3Feature({ fromEnv: true }) from .../file-provider-s3\n  fileProviderS3Feature -> createFileProviderS3Feature()\n  @cosmicdrift/kumiko-bundled-features/files-provider-s3 -> @cosmicdrift/kumiko-bundled-features/file-provider-s3/lib",
+    "migration": "Run `bun kumiko-upgrade --apply`. It rewrites the imports and the env feature mount, and reports `typeof fileProviderS3EnvFeature` and re-exports of it with file and line.",
+    "codemod": "scripts/codemod/s3-imports.ts"
+  }
+]

package/src/personal-access-tokens/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.368.0",
+    "type": "improvement",
+    "title": "The token list screen takes a description and slots via listScreen",
+    "detail": "createPersonalAccessTokensFeature({ listScreen: { description, slots } }) sets the i18n description and the slots (for example a header component) of the api-tokens list, so an app can show instructions above the list and use the bundled screen directly instead of embedding it in its own dashboard. Without the option nothing changes. Both bundled token screens are now marked agent: { expose: false }, since the mint screen reveals the token plaintext."
+  },
   {
     "version": "0.365.0",
     "type": "fix",

package/src/template-resolver/changes.json

@@ -1,4 +1,29 @@
 [
+  {
+    "version": "0.367.0",
+    "type": "improvement",
+    "title": "Notifications can keep their mail template system-only",
+    "detail": "r.notification(name, { systemOnly: true }) marks the stored mail template as a platform text. Tenant admins no longer see it in the template overview, list or detail, and creating a tenant version (upsert-tenant, copy-locale, import-bundle, also a SystemAdmin writing for a tenant) is refused with access_denied and templateResolver.errors.systemOnlyTemplate. SystemAdmins edit the system template as before, and the mail renderer always uses it, even if a tenant row exists from before."
+  },
+  {
+    "version": "0.367.0",
+    "type": "fix",
+    "title": "Rich text placeholders no longer nest paragraphs",
+    "detail": "A richText placeholder alone in a paragraph compiles into a div that keeps the paragraph attributes, and one inside other text renders inline with line breaks instead of its own paragraphs. Mails and PDFs no longer contain <p><p>. richText and stepIs are now reserved template variable names, like the other renderer helpers.",
+    "migration": "A notification that declares a template variable called richText, stepIs or percent fails at boot; rename the variable."
+  },
+  {
+    "version": "0.367.0",
+    "type": "improvement",
+    "title": "Template bundles with a logo can be seeded",
+    "detail": "seedSystemTemplateBundle(db, bundle, { dispatcher }) now seeds bundles that carry resources such as a logo by running the import-bundle-system write on the given seed dispatcher. With ifExists \"skip\" (default) nothing is written when every locale row already exists; if only some exist, the whole bundle is imported again. Without a dispatcher such a bundle still fails with a message that names the missing option."
+  },
+  {
+    "version": "0.367.0",
+    "type": "improvement",
+    "title": "Template conditions with data-if and a percent variable type",
+    "detail": "A paragraph, heading or table row with data-if=\"name\" renders only when the variable has a value (0 counts as a value); inside a repeat row the name refers to the row field, on the repeat row itself to the root variable. The sanitizer keeps the attribute, and template validation reports a condition on an undeclared variable. New variable type percent (templateVariable.percent()) takes percentage points and renders locale-aware, 12 as \"12 %\" in German and \"12%\" in English; the preview uses its example value. The document designer has no toolbar control for conditions yet; the attribute survives editing."
+  },
   {
     "version": "0.365.0",
     "type": "breaking",

package/src/user/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.368.0",
+    "type": "fix",
+    "title": "Soft-deleted users no longer count as active principals",
+    "detail": "A user deleted through the entity executor keeps its last status (usually active) with isDeleted set. principalStatusPlugin, the session checker and the PAT role resolver only looked at the status, so existing sessions and tokens of such a user stayed valid. They now treat isDeleted as blocked (session \"blocked\", PAT 401, principal_blocked for membership resolution) through the new isPrincipalRowBlocked predicate."
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/src/user-data-rights/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.367.0",
+    "type": "fix",
+    "title": "Tests seed tenant memberships and events through the framework",
+    "detail": "Test-only change. Integration tests create read_tenant_memberships from tenantMembershipEntity and seed rows with seedRow instead of hand-written DDL and raw INSERTs. Fake events go through the event-store append, and backdated audit events are written with runSeedWritesAt instead of an UPDATE on created_at. No runtime behavior changes."
+  },
   {
     "version": "0.365.0",
     "type": "improvement",

package/dist/file-provider-s3-env/feature.d.ts

@@ -1,3 +0,0 @@
-export declare const fileProviderS3EnvFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
-    readonly exports: void;
-};

package/dist/file-provider-s3-env/feature.js

@@ -1,46 +0,0 @@
-// kumiko-feature-version: 1
-//
-// file-provider-s3-env — S3 file provider configured entirely from
-// process.env. ONE shared bucket for ALL tenants: wire it by setting the
-// `S3_*` env vars + mounting — no per-tenant admin seeding and no
-// `secrets`-feature dependency.
-//
-// **vs file-provider-s3:** the config-based `"s3"` provider owns per-tenant
-// config keys + an encrypted `s3.secretAccessKey` secret (per-tenant
-// buckets, admin-seeded). This `"s3-env"` provider reads one credential set
-// from env and serves every tenant from one bucket — the
-// Hetzner-Object-Storage / single-bucket deploy case. Tenant isolation
-// still holds: file keys carry the tenant (export ZIPs:
-// `exports/<tenantId>/<jobId>.zip`) or are globally-unique UUIDs (fileRefs).
-//
-// **Pattern-Vorbild:** mirrors file-provider-inmemory (zero admin seeding,
-// only the file-foundation plugin-point required).
-//
-// **Env vars** (read by createS3ProviderFromEnv, prefix `S3_`):
-//   required — S3_BUCKET, S3_REGION, S3_ACCESS_KEY, S3_SECRET_KEY
-//   optional — S3_ENDPOINT (S3-compat stores incl. Hetzner Object Storage),
-//              S3_FORCE_PATH_STYLE
-// Missing required vars throw on the FIRST file op (inside the export cron).
-// The user-data-rights boot guard surfaces that at boot instead.
-import { createS3ProviderFromEnv } from "@cosmicdrift/kumiko-bundled-features/files-provider-s3";
-import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
-const FEATURE_NAME = "file-provider-s3-env";
-export const fileProviderS3EnvFeature = defineFeature(FEATURE_NAME, (r) => {
-    r.describe('Registers an `"s3-env"` provider for `file-foundation` that reads one S3 credential set from `process.env` (`S3_BUCKET`/`S3_REGION`/`S3_ACCESS_KEY`/`S3_SECRET_KEY`, optional `S3_ENDPOINT`/`S3_FORCE_PATH_STYLE`) and serves every tenant from one shared bucket — no per-tenant config or secret seeding. Use this for single-bucket S3-compatible deploys (e.g. Hetzner Object Storage); use `file-provider-s3` instead when each tenant needs its own bucket/credentials.');
-    r.uiHints({
-        displayLabel: "File Provider · S3 (env)",
-        category: "storage",
-        recommended: false,
-    });
-    // No requires on "config" or "secrets" — credentials come from
-    // env, not the per-tenant config + secrets store. Only the file-foundation
-    // plugin-extension-point must be mounted.
-    r.requires({ features: ["file-foundation"] });
-    const plugin = {
-        // tenantId ignored: one shared bucket serves all tenants (isolation via
-        // tenant-prefixed / UUID keys). Built fresh per call like file-provider-s3;
-        // the S3 client opens no connection at construction.
-        build: async (_ctx, _tenantId) => createS3ProviderFromEnv(), // @wrapper-known semantic-alias
-    };
-    r.useExtension("fileProvider", "s3-env", plugin);
-});