@cosmicdrift/kumiko-bundled-features 0.367.0 → 0.368.0

package/dist/audit/handlers/details.query.js

@@ -2,7 +2,7 @@
 // screen. Tenant-isolated at the WHERE level like list.query, so a caller
 // can only read events in their own tenant; a SystemAdmin can pass scope
 // "system" to read app-instance system events (e.g. app.started).
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import * as z from "zod";

package/dist/audit/handlers/list.query.js

@@ -11,7 +11,7 @@
 //
 // Event payloads hold PII as subject-KMS ciphertext; it is replaced by
 // REDACTED_PII_PLACEHOLDER before returning, since the API leak guard refuses ciphertext.
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";

package/dist/audit/run-escape-hatch-retention.js

@@ -1,5 +1,5 @@
-import { aggregateWhere, runnerCanBeginTransaction, selectMany, } from "@cosmicdrift/kumiko-framework/bun-db";
 import { COMPLIANCE_PROFILES, subtractRetentionSpec, } from "@cosmicdrift/kumiko-framework/compliance";
+import { aggregateWhere, runnerCanBeginTransaction, selectMany, } from "@cosmicdrift/kumiko-framework/db";
 import { parseTenantId, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { pruneEvents } from "@cosmicdrift/kumiko-framework/pipeline";

package/dist/auth-email-password/bootstrap.js

@@ -5,7 +5,7 @@
 // invitation row holds membership role + global roles until the invitee
 // accepts through the regular invite-accept routes.
 import { makeDispatchSystemWrite, makeDispatchWriteAs, } from "@cosmicdrift/kumiko-framework/api";
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { ConfigScopes, createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 // kumiko-lint-ignore cross-feature-import bootstrap sets per-tenant config through the config feature's write handler

package/dist/auth-email-password/handlers/invite-accept-with-login.write.js

@@ -20,8 +20,7 @@
 // Unlike signup-confirm: no new tenant is created, no new user is created —
 // both already exist. The magic is the combined login+accept operation in
 // one round trip.
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb, fetchOne, } from "@cosmicdrift/kumiko-framework/db";
 import { buildSessionRoles, createSystemUser, defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
@@ -128,7 +127,11 @@ export function createInviteAcceptWithLoginHandler(opts = {}) {
                 if (!globalGrant.isSuccess)
                     return globalGrant;
                 // Invitation → accepted: TenantDb for the invitation's tenant.
-                const invitationTdb = createTenantDb(dbConn, invitationTenantId, "system");
+                const invitationTdb = createTenantDb({
+                    db: dbConn,
+                    tenantId: invitationTenantId,
+                    mode: "system",
+                });
                 const updateResult = await invitationExecutor.update({
                     id: invitationId,
                     version: invitationVersion,

package/dist/auth-email-password/handlers/invite-accept.write.js

@@ -14,8 +14,7 @@
 // Branch 1 ist der klassische "shared workspace bei eingeloggter
 // Session"-Flow. Branch 2 (anon + existing email) und Branch 3 (anon +
 // new email) kommen als separate Handler.
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb, fetchOne, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
@@ -108,7 +107,11 @@ export function createInviteAcceptHandler() {
                 // Tenant-scoping: ctx.db ist auf event.user.tenantId gescopt
                 // (= NICHT der invitation-tenant). Eigene TenantDb für den
                 // invitation-tenant bauen damit der executor die row findet.
-                const invitationTdb = createTenantDb(dbConn, invitationTenantId, "system");
+                const invitationTdb = createTenantDb({
+                    db: dbConn,
+                    tenantId: invitationTenantId,
+                    mode: "system",
+                });
                 const updateResult = await invitationExecutor.update({
                     id: invitationId,
                     version: invitationVersion,

package/dist/auth-email-password/handlers/invite-info.query.js

@@ -4,7 +4,7 @@
 // the user submits anything. Unlike the accept handlers, this never touches
 // the token store — the token is not burned and stays usable for the
 // actual accept call.
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/dist/auth-email-password/handlers/invite-signup-complete.write.js

@@ -16,8 +16,7 @@
 //      d. Add membership im invited Tenant
 //      e. Invitation → accepted, Token gelöscht
 //   5. Response: SessionUser + tenantId für Auto-Login
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb, fetchOne, } from "@cosmicdrift/kumiko-framework/db";
 import { buildSessionRoles, createSystemUser, defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
@@ -114,7 +113,11 @@ export function createInviteSignupCompleteHandler(opts = {}) {
                     roles: [invitationRole],
                 });
                 // Invitation → accepted: TenantDb für invitation-tenant
-                const invitationTdb = createTenantDb(dbConn, invitationTenantId, "system");
+                const invitationTdb = createTenantDb({
+                    db: dbConn,
+                    tenantId: invitationTenantId,
+                    mode: "system",
+                });
                 const updateResult = await invitationExecutor.update({
                     id: invitationId,
                     version: invitationVersion,

package/dist/auth-email-password/handlers/signup-confirm.write.js

@@ -18,7 +18,7 @@
 // Failure-Recovery: jeder Pfad nach dem burn checked `committed`-Flag;
 // bei !committed wird der burn released damit ein legitimer Retry
 // nicht durch einen stale Marker geblockt wird (wie reset/verify).
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { ConflictError, InternalError, reraiseAsKumikoError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { generateUniqueName } from "@cosmicdrift/kumiko-framework/random";

package/dist/auth-email-password/seeding.js

@@ -11,11 +11,11 @@
 //   3. seedTenant + seedTenantMembership aus tenant/seeding
 // Damit Sample-Server und Tests keine drei sub-paths zusammensammeln
 // müssen.
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredBlindIndexKey, configuredPiiSubjectKms, decryptPiiFieldValues, } from "@cosmicdrift/kumiko-framework/crypto";
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { ConflictError } from "@cosmicdrift/kumiko-framework/errors";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
-import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
+import { TestUsers } from "@cosmicdrift/kumiko-framework/seeding";
 import { hashPassword } from "../shared/index.js";
 // kumiko-lint-ignore cross-feature-import auth-tests need user+tenant seed-helpers
 import { seedTenant, seedTenantMembership } from "../tenant/seeding.js";

package/dist/auth-foundation/feature.d.ts

@@ -2,6 +2,10 @@ import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import { type Registry } from "@cosmicdrift/kumiko-framework/engine";
 import { type AuthProviderBuildDeps, type SessionStore, type TenantExistsFn, type TenantResolverFn, type TenantResolverTrust } from "./types.js";
 export { EXT_SESSION_STORE, EXT_TENANT_EXISTENCE, EXT_TENANT_RESOLVER, EXT_TOKEN_VERIFIER, } from "./types.js";
+export declare function createAuthFoundationFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: void;
+};
+/** @deprecated Use createAuthFoundationFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const authFoundationFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };

package/dist/auth-foundation/feature.js

@@ -14,39 +14,43 @@ import { validateSessionStoreMultiplicity, validateTenantExistenceMultiplicity,
 import { EXT_SESSION_STORE, EXT_TENANT_EXISTENCE, EXT_TENANT_RESOLVER, EXT_TOKEN_VERIFIER, isAuthProviderPlugin, isSessionStoreProvider, isTenantExistenceProvider, isTenantResolverProvider, tokenShapeMatches, } from "./types.js";
 export { EXT_SESSION_STORE, EXT_TENANT_EXISTENCE, EXT_TENANT_RESOLVER, EXT_TOKEN_VERIFIER, } from "./types.js";
 const FEATURE_NAME = "auth-foundation";
-export const authFoundationFeature = defineFeature(FEATURE_NAME, (r) => {
-    r.describe("Declares auth-middleware extension points: `tokenVerifier` (Bearer), `sessionStore` (revocable JWT sid), optional `tenantResolver` + `tenantExistence` for anonymous multi-tenant. Provider-features register via r.useExtension; mount auth-foundation with the matching provider features.");
-    r.uiHints({
-        displayLabel: "Auth Provider Foundation",
-        category: "identity",
-        recommended: false,
-    });
-    r.extendsRegistrar(EXT_TOKEN_VERIFIER, {
-        onRegister: () => {
-            // No side-effects at register-time — registry stores the usage,
-            // resolveTokenVerifier looks it up at request-time.
-        },
-    });
-    r.bootCheck(({ features }) => validateTokenVerifierMultiplicity(features));
-    r.extendsRegistrar(EXT_SESSION_STORE, {
-        onRegister: () => {
-            // No side-effects at register-time — resolveSessionStore at boot/request.
-        },
-    });
-    r.bootCheck(({ features }) => validateSessionStoreMultiplicity(features));
-    r.extendsRegistrar(EXT_TENANT_RESOLVER, {
-        onRegister: () => {
-            // Optional — zero providers is fine (single-tenant / header-cookie).
-        },
-    });
-    r.bootCheck(({ features }) => validateTenantResolverMultiplicity(features));
-    r.extendsRegistrar(EXT_TENANT_EXISTENCE, {
-        onRegister: () => {
-            // Optional — zero providers skips the existence check.
-        },
-    });
-    r.bootCheck(({ features }) => validateTenantExistenceMultiplicity(features));
-});
+export function createAuthFoundationFeature() {
+    return defineFeature(FEATURE_NAME, (r) => {
+        r.describe("Declares auth-middleware extension points: `tokenVerifier` (Bearer), `sessionStore` (revocable JWT sid), optional `tenantResolver` + `tenantExistence` for anonymous multi-tenant. Provider-features register via r.useExtension; mount auth-foundation with the matching provider features.");
+        r.uiHints({
+            displayLabel: "Auth Provider Foundation",
+            category: "identity",
+            recommended: false,
+        });
+        r.extendsRegistrar(EXT_TOKEN_VERIFIER, {
+            onRegister: () => {
+                // No side-effects at register-time — registry stores the usage,
+                // resolveTokenVerifier looks it up at request-time.
+            },
+        });
+        r.bootCheck(({ features }) => validateTokenVerifierMultiplicity(features));
+        r.extendsRegistrar(EXT_SESSION_STORE, {
+            onRegister: () => {
+                // No side-effects at register-time — resolveSessionStore at boot/request.
+            },
+        });
+        r.bootCheck(({ features }) => validateSessionStoreMultiplicity(features));
+        r.extendsRegistrar(EXT_TENANT_RESOLVER, {
+            onRegister: () => {
+                // Optional — zero providers is fine (single-tenant / header-cookie).
+            },
+        });
+        r.bootCheck(({ features }) => validateTenantResolverMultiplicity(features));
+        r.extendsRegistrar(EXT_TENANT_EXISTENCE, {
+            onRegister: () => {
+                // Optional — zero providers skips the existence check.
+            },
+        });
+        r.bootCheck(({ features }) => validateTenantExistenceMultiplicity(features));
+    }, { dedupeOptions: {} });
+}
+/** @deprecated Use createAuthFoundationFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const authFoundationFeature = createAuthFoundationFeature();
 /**
  * Tries every registered tokenVerifier provider's shape against `rawToken`
  * in registration order and calls the first match's verifier. Returns null

package/dist/auth-foundation/index.d.ts

@@ -1,3 +1,3 @@
-export { authFoundationFeature, type ResolvedTenantResolver, resolveSessionStore, resolveTenantExistence, resolveTenantResolver, resolveTokenVerifier, } from "./feature.js";
+export { authFoundationFeature, createAuthFoundationFeature, type ResolvedTenantResolver, resolveSessionStore, resolveTenantExistence, resolveTenantResolver, resolveTokenVerifier, } from "./feature.js";
 export { resolveAnonymousAccessFromRegistry } from "./resolve-anonymous-access.js";
 export { type AuthProviderBuildDeps, type AuthProviderPlugin, type AuthVerifier, EXT_SESSION_STORE, EXT_TENANT_EXISTENCE, EXT_TENANT_RESOLVER, EXT_TOKEN_VERIFIER, isAuthProviderPlugin, isSessionStoreProvider, isTenantExistenceProvider, isTenantResolverProvider, isTenantResolverTrust, isValidTokenShape, type SessionMassRevoker, type SessionStore, type SessionStoreProvider, type TenantExistenceProvider, type TenantExistsFn, type TenantResolverFn, type TenantResolverProvider, type TenantResolverTrust, type TokenShape, tokenShapeKey, tokenShapeMatches, } from "./types.js";

package/dist/auth-foundation/index.js

@@ -1,4 +1,4 @@
 // Public API of the auth-foundation bundled-feature.
-export { authFoundationFeature, resolveSessionStore, resolveTenantExistence, resolveTenantResolver, resolveTokenVerifier, } from "./feature.js";
+export { authFoundationFeature, createAuthFoundationFeature, resolveSessionStore, resolveTenantExistence, resolveTenantResolver, resolveTokenVerifier, } from "./feature.js";
 export { resolveAnonymousAccessFromRegistry } from "./resolve-anonymous-access.js";
 export { EXT_SESSION_STORE, EXT_TENANT_EXISTENCE, EXT_TENANT_RESOLVER, EXT_TOKEN_VERIFIER, isAuthProviderPlugin, isSessionStoreProvider, isTenantExistenceProvider, isTenantResolverProvider, isTenantResolverTrust, isValidTokenShape, tokenShapeKey, tokenShapeMatches, } from "./types.js";

package/dist/auth-mfa/db/queries.js

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, fetchOne, } from "@cosmicdrift/kumiko-framework/db";
 import { parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";
 import { userMfaEntity, userMfaTable } from "../schema/user-mfa.js";
 const executor = createEventStoreExecutor(userMfaTable, userMfaEntity, {

package/dist/auth-mfa/handlers/enable-confirm-preauth.write.js

@@ -92,7 +92,7 @@ export function createEnableConfirmPreauthHandler(opts) {
                 return invalidSetupToken();
             // "system" mode: no session exists yet, tenantId comes from the
             // verified token, mirroring enable-start-preauth.write.ts.
-            const scopedDb = createTenantDb(ctx.db.unsafeRaw(), tenantId, "system");
+            const scopedDb = createTenantDb({ db: ctx.db.unsafeRaw(), tenantId, mode: "system" });
             const scopedUser = { id: userId, tenantId, roles: ["User"] };
             const existing = await findUserMfaRow(scopedDb, scopedUser);
             if (existing)

package/dist/auth-mfa/handlers/enable-start-preauth.write.js

@@ -44,7 +44,7 @@ export function createEnableStartPreauthHandler(opts) {
             // "system" mode: the guest dispatch identity's own tenantId is
             // meaningless here — the preauthSetupToken is the source of truth
             // for which tenant's row to read, mirroring verify.write.ts.
-            const scopedDb = createTenantDb(ctx.db.unsafeRaw(), tenantId, "system");
+            const scopedDb = createTenantDb({ db: ctx.db.unsafeRaw(), tenantId, mode: "system" });
             const scopedUser = { id: userId, tenantId, roles: ["User"] };
             const existing = await findUserMfaRow(scopedDb, scopedUser);
             if (existing)

package/dist/auth-mfa/handlers/reencrypt.job.js

@@ -22,9 +22,8 @@
 // (the very risk this job's plan entry called out: a rebuild resurrecting
 // an old-KEK wrap would happen if rotation only touched the read-side
 // projection instead of appending a real `.updated` event).
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { collectPiiSubjectFields, configuredPiiSubjectKms, decryptPiiFieldValues, } from "@cosmicdrift/kumiko-framework/crypto";
-import { configuredEntityFieldEncryption, createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-framework/db";
+import { configuredEntityFieldEncryption, createEventStoreExecutor, createTenantDb, selectMany, } from "@cosmicdrift/kumiko-framework/db";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { classifyStoredEnvelope, runChunkedMigration, } from "../../shared/index.js";
 import { userMfaEntity, userMfaTable } from "../schema/user-mfa.js";
@@ -66,7 +65,7 @@ export async function mfaReencryptJob(rawPayload, ctx, db) {
     function tdbFor(tenantId) {
         let existing = tdbCache.get(tenantId);
         if (!existing) {
-            existing = createTenantDb(db, tenantId, "system");
+            existing = createTenantDb({ db, tenantId, mode: "system" });
             tdbCache.set(tenantId, existing);
         }
         return existing;

package/dist/auth-mfa/handlers/status.query.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { userMfaTable } from "../schema/user-mfa.js";

package/dist/auth-mfa/handlers/verify.write.js

@@ -69,7 +69,7 @@ export function createMfaVerifyHandler(opts) {
             // "system" mode: this handler runs with a guest identity whose own
             // tenantId is meaningless here — the challenge token is the source
             // of truth for which tenant's row to read.
-            const scopedDb = createTenantDb(ctx.db.unsafeRaw(), tenantId, "system");
+            const scopedDb = createTenantDb({ db: ctx.db.unsafeRaw(), tenantId, mode: "system" });
             const scopedUser = { id: userId, tenantId, roles: ["User"] };
             const row = await findUserMfaRow(scopedDb, scopedUser);
             // MFA got disabled between login and verify (race, or a stale

package/dist/auth-mfa/mfa-code-verifier.js

@@ -14,7 +14,7 @@ export function createMfaCodeVerifier() {
         declareEscapeHatch({
             reason: "reads the MFA enrollment of the user being re-authenticated on the caller's handler context; the calling handler declares its own escapeHatch",
         });
-        const scopedDb = createTenantDb(ctx.db.unsafeRaw(), tenantId, "system");
+        const scopedDb = createTenantDb({ db: ctx.db.unsafeRaw(), tenantId, mode: "system" });
         const row = await findUserMfaRow(scopedDb, { id: userId, tenantId, roles: [] });
         if (!row)
             return { enrolled: false, ok: false };

package/dist/auth-mfa/mfa-status-checker.js

@@ -10,7 +10,7 @@ export function createMfaStatusChecker(opts) {
         declareEscapeHatch({
             reason: "reads the MFA enrollment of the tenant named in the signed login/setup token, not the guest dispatch tenant, on the caller's handler context; the calling handler declares its own escapeHatch",
         });
-        const scopedDb = createTenantDb(ctx.db.unsafeRaw(), tenantId, "system");
+        const scopedDb = createTenantDb({ db: ctx.db.unsafeRaw(), tenantId, mode: "system" });
         const scopedUser = { id: userId, tenantId, roles: ["User"] };
         const row = await findUserMfaRow(scopedDb, scopedUser);
         if (row) {

package/dist/auth-mfa-user-data/index.d.ts

@@ -1,3 +1,7 @@
+export declare function createAuthMfaUserDataFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: void;
+};
+/** @deprecated Use createAuthMfaUserDataFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const authMfaUserDataFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };

package/dist/auth-mfa-user-data/index.js

@@ -6,12 +6,16 @@
 // Mirrors folders-user-data.
 import { defineFeature, EXT_USER_DATA } from "@cosmicdrift/kumiko-framework/engine";
 import { userMfaDeleteHook, userMfaExportHook } from "./hooks.js";
-export const authMfaUserDataFeature = defineFeature("auth-mfa-user-data", (r) => {
-    r.describe("GDPR (Art. 20 export / Art. 17 erasure) coverage for the `auth-mfa` feature's `user-mfa` entity. Mounts the EXT_USER_DATA export + delete hooks so 2FA enrollment status is included in the user-data export bundle and a user's TOTP secret + recovery codes are hard-deleted (via executor.forget, rebuild-safe) on a data-subject erasure request. Kept separate from `auth-mfa` so consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `auth-mfa`.");
-    r.requires({ features: ["user-data-rights"] });
-    r.optionalRequires("auth-mfa");
-    r.useExtension(EXT_USER_DATA, "user-mfa", {
-        export: userMfaExportHook,
-        delete: userMfaDeleteHook,
-    });
-});
+export function createAuthMfaUserDataFeature() {
+    return defineFeature("auth-mfa-user-data", (r) => {
+        r.describe("GDPR (Art. 20 export / Art. 17 erasure) coverage for the `auth-mfa` feature's `user-mfa` entity. Mounts the EXT_USER_DATA export + delete hooks so 2FA enrollment status is included in the user-data export bundle and a user's TOTP secret + recovery codes are hard-deleted (via executor.forget, rebuild-safe) on a data-subject erasure request. Kept separate from `auth-mfa` so consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `auth-mfa`.");
+        r.requires({ features: ["user-data-rights"] });
+        r.optionalRequires("auth-mfa");
+        r.useExtension(EXT_USER_DATA, "user-mfa", {
+            export: userMfaExportHook,
+            delete: userMfaDeleteHook,
+        });
+    }, { dedupeOptions: {} });
+}
+/** @deprecated Use createAuthMfaUserDataFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const authMfaUserDataFeature = createAuthMfaUserDataFeature();

package/dist/billing-foundation/billing-info-query.js

@@ -5,7 +5,7 @@
 // off the app's extraContext.
 //
 // Deliberately does NOT call defineQueryHandler itself: apps use different
-// wrappers around it (publicstatus's `@app/define`, which adds
+// wrappers around it (publicstatus's own wrapper, which adds
 // `agent: { expose: false }`; show-pony's plain framework
 // `defineQueryHandler`). Calling defineQueryHandler here would bypass
 // whatever an app's own wrapper does. Instead this factory returns just the

package/dist/billing-foundation/feature.d.ts

@@ -1,4 +1,5 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import type { BillingFoundationOptions } from "./types.js";
 export declare function createBillingFoundationFeature<TTier extends string = string>(options?: BillingFoundationOptions<TTier>): FeatureDefinition;
+/** @deprecated Use createBillingFoundationFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const billingFoundationFeature: FeatureDefinition;

package/dist/billing-foundation/feature.js

@@ -111,7 +111,9 @@ export function createBillingFoundationFeature(options = {}) {
         r.defineEvent(SUBSCRIPTION_CANCELED_EVENT_SHORT, subscriptionEventPayloadSchema, {
             piiFields: "none",
         });
-        r.defineEvent(INVOICE_PAID_EVENT_SHORT, subscriptionEventPayloadSchema, { piiFields: "none" });
+        r.defineEvent(INVOICE_PAID_EVENT_SHORT, subscriptionEventPayloadSchema, {
+            piiFields: "none",
+        });
         r.defineEvent(INVOICE_PAYMENT_FAILED_EVENT_SHORT, subscriptionEventPayloadSchema, {
             piiFields: "none",
         });
@@ -215,10 +217,7 @@ export function createBillingFoundationFeature(options = {}) {
             destroy: paymentTenantDestroyHook,
             escapeHatch: { reason: PAYMENT_TENANT_DESTROY_ARCHIVE_REASON },
         });
-    });
+    }, Object.keys(options).length === 0 ? { dedupeOptions: {} } : undefined);
 }
-// Back-compat: existing consumers importing the plain const keep working
-// unchanged (no baseUrl/catalog — create-checkout-session's redirect-origin
-// check then rejects every call as UnconfiguredError, matching the
-// changes.json migration note).
+/** @deprecated Use createBillingFoundationFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export const billingFoundationFeature = createBillingFoundationFeature();

package/dist/billing-foundation/handlers/create-portal-session.write.js

@@ -12,8 +12,8 @@
 // **returnUrl:** computed server-side via `portalReturnUrl` (catalog's
 // returnPath, or baseUrl itself) — the client no longer supplies one, so
 // there is no client-controlled redirect to harden against.
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, decryptPiiFieldValues, } from "@cosmicdrift/kumiko-framework/crypto";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import * as z from "zod";
 import { subscriptionAggregateId } from "../aggregate-id.js";
 import { portalReturnUrl, resolveProviderPlugin } from "../checkout-core.js";

package/dist/billing-foundation/projection.js

@@ -13,8 +13,7 @@
 // foundation production mounten müssen die Tabelle in ihre eigene
 // `drizzle/generate.ts` ergänzen (= via subscriptionsProjectionTable-
 // import). setupTestStack pusht sie automatisch via r.projection.table.
-import { insertOnConflictDoNothing, requireEntityTableMeta, upsertOnConflict, } from "@cosmicdrift/kumiko-framework/bun-db";
-import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
+import { buildEntityTable, insertOnConflictDoNothing, requireEntityTableMeta, upsertOnConflict, } from "@cosmicdrift/kumiko-framework/db";
 import { defineApply } from "@cosmicdrift/kumiko-framework/engine";
 import { paymentRowId } from "./aggregate-id.js";
 import { paymentEntity, subscriptionEntity } from "./entities.js";

package/dist/cap-counter/calendar-cap-usage-reservation.d.ts

@@ -8,6 +8,7 @@ export type CalendarCapUsageReservationSpec = Omit<CalendarCapDef, "amount" | "n
     readonly outsideTransaction?: boolean;
 };
 export type CalendarCapUsageReservation = {
+    readonly reservationId: string;
     readonly amount: number;
     readonly counterValue: number;
     settle(actualAmount: number): Promise<void>;
@@ -15,3 +16,9 @@ export type CalendarCapUsageReservation = {
 };
 export declare function reserveEnforcedCalendarCap(ctx: CapCounterContext, cap: CalendarCapUsageReservationSpec): Promise<CalendarCapReservation>;
 export declare function reserveCalendarCapUsage(ctx: CapCounterContext, spec: CalendarCapUsageReservationSpec): Promise<CalendarCapUsageReservation>;
+export type CalendarCapReservationHandleSpec = Pick<CalendarCapUsageReservationSpec, "capName" | "periodStartIso" | "outsideTransaction">;
+export type CalendarCapReservationHandle = {
+    consume(units: number): Promise<void>;
+    release(): Promise<void>;
+};
+export declare function calendarCapReservationHandle(ctx: CapCounterContext, reservationId: string, spec: CalendarCapReservationHandleSpec): CalendarCapReservationHandle;

package/dist/cap-counter/calendar-cap-usage-reservation.js

@@ -1,4 +1,4 @@
-import { releaseExpiredCapReservations, reserveCalendarCap, settleCalendarCapReservation, } from "./cap-reservation.js";
+import { consumeCalendarCapReservation, releaseCapReservation, releaseExpiredCapReservations, reserveCalendarCap, settleCalendarCapReservation, } from "./cap-reservation.js";
 import { assertBelowHardCap, enforceCapAndMaybeNotify, } from "./enforce-cap.js";
 // Shared by withCapEnforcement and the public reservation API so both enforce identically.
 export async function reserveEnforcedCalendarCap(ctx, cap) {
@@ -29,6 +29,7 @@ export async function reserveCalendarCapUsage(ctx, spec) {
     const reservation = await reserveEnforcedCalendarCap(ctx, spec);
     let state = "open";
     return {
+        reservationId: reservation.reservationId,
         amount: spec.amount,
         counterValue: reservation.counterValue,
         async settle(actualAmount) {
@@ -37,7 +38,11 @@ export async function reserveCalendarCapUsage(ctx, spec) {
             }
             state = "settled";
             try {
-                await settleCalendarCapReservation(ctx, reservation.reservationId, { capName: spec.capName, periodStartIso: spec.periodStartIso, actualAmount }, outsideTransaction);
+                await settleCalendarCapReservation(ctx, reservation.reservationId, {
+                    capName: spec.capName,
+                    periodStartIso: spec.periodStartIso,
+                    actualAmount,
+                }, outsideTransaction);
             }
             catch (error) {
                 state = "open";
@@ -53,3 +58,24 @@ export async function reserveCalendarCapUsage(ctx, spec) {
         },
     };
 }
+// Addresses a reservation by id so a job can consume it per unit; capName and period are needed
+// because the row may already be swept, in which case consume books the units directly.
+export function calendarCapReservationHandle(ctx, reservationId, spec) {
+    const outsideTransaction = spec.outsideTransaction ?? true;
+    let released = false;
+    return {
+        async consume(units) {
+            if (released) {
+                throw new Error(`cap-counter: reservation for "${spec.capName}" is already released`);
+            }
+            await consumeCalendarCapReservation(ctx, reservationId, { capName: spec.capName, periodStartIso: spec.periodStartIso, units }, outsideTransaction);
+        },
+        async release() {
+            // skip: release is idempotent, a second call has nothing left to give back
+            if (released)
+                return;
+            await releaseCapReservation(ctx, reservationId, outsideTransaction);
+            released = true;
+        },
+    };
+}

package/dist/cap-counter/cap-reservation.d.ts

@@ -1,3 +1,4 @@
+import { UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import type { ReservationHandle } from "@cosmicdrift/kumiko-types/handlers";
 import { type BookCapUsageOptions, type CapCounterContext, type ReadRollingCapUsageOptions } from "./book-cap-usage.js";
 export type CalendarCapReservation = ReservationHandle & {
@@ -17,5 +18,20 @@ export type SettleCalendarCapOptions = {
     readonly periodStartIso: string;
     readonly actualAmount: number;
 };
+export declare class CapSettleBelowConsumedError extends UnprocessableError {
+    constructor(capName: string, consumed: number, actualAmount: number);
+}
+export declare class CapReservationSettledError extends UnprocessableError {
+    constructor(capName: string);
+}
 export declare function settleCalendarCapReservation(ctx: CapCounterContext, id: string, options: SettleCalendarCapOptions, outsideTransaction?: boolean): Promise<void>;
+export type ConsumeCalendarCapOptions = {
+    readonly capName: string;
+    readonly periodStartIso: string;
+    readonly units: number;
+};
+export declare class CapReservationOverConsumedError extends UnprocessableError {
+    constructor(capName: string, remaining: number, requested: number);
+}
+export declare function consumeCalendarCapReservation(ctx: CapCounterContext, id: string, options: ConsumeCalendarCapOptions, outsideTransaction?: boolean): Promise<void>;
 export declare function releaseExpiredCapReservations(ctx: CapCounterContext, capName: string, outsideTransaction?: boolean): Promise<void>;