@cosmicdrift/kumiko-bundled-features 0.367.0 → 0.368.0

package/dist/user-data-rights/lib/update-user-lifecycle.js

@@ -1,5 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb, selectMany, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { USER_STATUS, userEntity, userTable } from "../../user/index.js";
@@ -38,11 +37,12 @@ export async function updateUserLifecycle(conn, userId, changes, options) {
     // (restrict/lift-restriction/grace-period/cancel/forget) that holds no row
     // version to pass as `payload.version`, which update() requires otherwise.
     // Callers needing a guard use `options.expect` instead.
-    const tenantDb = createTenantDb(conn, SYSTEM_TENANT_ID, "system");
+    const tenantDb = createTenantDb({ db: conn, tenantId: SYSTEM_TENANT_ID, mode: "system" });
     const result = await userExecutor.update({ id: userId, changes }, createSystemUser(SYSTEM_TENANT_ID), tenantDb, {
         skipOptimisticLock: true,
         ...(options?.expect && { expect: options.expect }),
         ...(options?.writePurpose && { writePurpose: options.writePurpose }),
+        ...(options?.includeDeleted && { includeDeleted: true }),
     });
     if (result.isSuccess)
         return { applied: true };

package/dist/user-data-rights/run-export-jobs.js

@@ -43,10 +43,9 @@
 // **Storage-Cleanup:** dritter Pass loescht abgelaufene downloadStorageKeys
 // (`expiresAt + exportStorageCleanupGraceHours < now`) — abgelaufene ZIPs
 // auf S3 sollen nicht ewig liegen.
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { addDurationSpec } from "@cosmicdrift/kumiko-framework/compliance";
 import { PII_ERASED_SENTINEL } from "@cosmicdrift/kumiko-framework/crypto";
-import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb, fetchOne, selectMany, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser } from "@cosmicdrift/kumiko-framework/engine";
 import { createZipStream, tenantExportPrefix, } from "@cosmicdrift/kumiko-framework/files";
 import { resolveProfileForTenant } from "../compliance-profiles/index.js";
@@ -547,7 +546,7 @@ function reportCleanupLastRun(metrics, now) {
 // Stream-Counter konsistent bleibt (Memory feedback_event_store_tenant_consistency).
 // @wrapper-known semantic-alias
 function systemTenantDb(db, tenantId) {
-    return createTenantDb(db, tenantId, "system");
+    return createTenantDb({ db, tenantId, mode: "system" });
 }
 function buildExportStorageKey(job) {
     return `${tenantExportPrefix(job.requestedFromTenantId)}${job.id}.zip`;

package/dist/user-data-rights/run-forget-cleanup.js

@@ -34,9 +34,8 @@ import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 // gesammelt + zurueckgegeben fuer Operator-Visibility. Ein User mit
 // gefailten Hooks bleibt im DeletionRequested-Status (next Lauf
 // retried automatisch).
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
-import { createTenantDb, entityEventName, executeRawQuery, nullBlindIndexesForSubject, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
+import { createTenantDb, entityEventName, executeRawQuery, fetchOne, nullBlindIndexesForSubject, selectMany, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
 import { EXT_USER_DATA, EXT_USER_DATA_ORDER, extensionUsageEscapeHatchReason, } from "@cosmicdrift/kumiko-framework/engine";
 import { createEscapeHatchReporter, UNATTRIBUTED_ACTOR, } from "@cosmicdrift/kumiko-framework/pipeline";
 import { purgeSearchDocumentsForSubject, } from "@cosmicdrift/kumiko-framework/search";
@@ -54,9 +53,14 @@ function buildHookDb(db, tenantId, entry, args) {
         sink: args.escapeHatchAuditSink,
         log: args.escapeHatchAuditLog ?? createFallbackLogger("user-data-rights"),
     });
-    return createTenantDb(db, tenantId, "tenant", undefined, undefined, undefined, {
-        unsafeRaw: entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
-        report,
+    return createTenantDb({
+        db,
+        tenantId,
+        mode: "tenant",
+        grants: {
+            unsafeRaw: entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
+            report,
+        },
     });
 }
 // EXT_USER_DATA delete-hooks default here; a hook that redacts data keyed on an

package/dist/user-data-rights/run-user-export.js

@@ -20,9 +20,8 @@ import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 // **PII-Surface:** Hooks definieren selbst welche Felder ins Bundle
 // landen. user-data-rights-defaults/hooks/user.userdata-hook expose
 // expliziert KEIN passwordHash + KEINE roles (privileged columns).
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, } from "@cosmicdrift/kumiko-framework/crypto";
-import { collectEncryptedFieldNames, configuredEntityFieldEncryption, createTenantDb, decryptEntityFieldValues, } from "@cosmicdrift/kumiko-framework/db";
+import { collectEncryptedFieldNames, configuredEntityFieldEncryption, createTenantDb, decryptEntityFieldValues, selectMany, } from "@cosmicdrift/kumiko-framework/db";
 import { EXT_USER_DATA, extensionUsageEscapeHatchReason, maskWriteOnlyFields, } from "@cosmicdrift/kumiko-framework/engine";
 import { createEscapeHatchReporter, UNATTRIBUTED_ACTOR, } from "@cosmicdrift/kumiko-framework/pipeline";
 import { tenantMembershipsTable } from "../tenant/index.js";
@@ -35,9 +34,14 @@ function buildHookDb(db, tenantId, entry, args) {
         sink: args.escapeHatchAuditSink,
         log: args.escapeHatchAuditLog ?? createFallbackLogger("user-data-rights"),
     });
-    return createTenantDb(db, tenantId, "tenant", undefined, undefined, undefined, {
-        unsafeRaw: entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
-        report,
+    return createTenantDb({
+        db,
+        tenantId,
+        mode: "tenant",
+        grants: {
+            unsafeRaw: entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
+            report,
+        },
     });
 }
 /**

package/dist/waitlist/handlers/invite.write.js

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { acquireNamespacedAdvisoryLock } from "@cosmicdrift/kumiko-framework/db";
+import { acquireNamespacedAdvisoryLock, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, defineWriteHandler, parseTenantId, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";

package/dist/waitlist/handlers/reject.write.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, defineWriteHandler, parseTenantId, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { cancelPendingInvitation, INVITATION_STATUS, tenantInvitationsTable, } from "../../tenant/index.js";

package/dist/waitlist/lib.js

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, fetchOne, } from "@cosmicdrift/kumiko-framework/db";
 import { access, createSystemUser, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { tenantMembershipsTable } from "../tenant/index.js";

package/dist/workflow-runner/event-subscriber.js

@@ -23,7 +23,7 @@
 // + triggerEventRef + wakeAt=now() onto the matching pending row(s); the
 // existing resume-due-runs job (Phase 2) picks the row up on its next
 // cron tick — the one resume path stays exactly the one Phase 2 built.
-import { selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany, updateMany } from "@cosmicdrift/kumiko-framework/db";
 import { evaluateEventMatch } from "@cosmicdrift/kumiko-framework/engine";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";

package/dist/workflow-runner/feature.d.ts

@@ -1,3 +1,7 @@
+export declare function createWorkflowRunnerFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: void;
+};
+/** @deprecated Use createWorkflowRunnerFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const workflowRunnerFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };

package/dist/workflow-runner/feature.js

@@ -32,45 +32,49 @@ import { workflowRunPendingTableMeta } from "./tables.js";
 // bundled feature's runtime name follows this convention, and
 // use-all-bundled's check-coverage matches exports to mounted features by it.
 const FEATURE_NAME = "workflow-runner";
-export const workflowRunnerFeature = defineFeature(FEATURE_NAME, (r) => {
-    r.describe("Writes the run-envelope (`workflow.run-started` / `workflow.run-completed` / `workflow.run-failed`) for a workflow run onto its `workflow-run` aggregate stream. Provides `startAndRunWorkflow` and `registerEventTrigger` for consumer features to wire up `defineWorkflow`-based workflows against domain events. Registers no workflows itself. Runs the resume loop for suspended `wait`/`retry`/`waitForEvent` steps (`resume-due-runs` job + `resume-run` handler); `registerEventTrigger` wires an event-wakeup subscriber per workflow that declares `awaits` so a `waitForEvent` step resumes as soon as its awaited event arrives, not just on timeout.");
-    r.uiHints({
-        displayLabel: "Workflow Runner",
-        category: "infrastructure",
-        recommended: false,
-    });
-    // resume-run needs a full HandlerContext + ctx.systemDb (the pending-row
-    // scan crosses whatever tenant the row belongs to relative to the job's
-    // own tenant loop iteration) — same reasoning as tenant/feature.ts.
-    r.systemScope();
-    r.storeTable(workflowRunPendingTableMeta, {
-        reason: "resume_loop.pending_suspended_steps",
-    });
-    registerWorkflowRunPendingProjection(r);
-    r.writeHandler(resumeRunHandler);
-    r.job("resume-due-runs", { trigger: { cron: "* * * * *" }, perTenant: true, concurrency: "skip" }, async (_payload, ctx) => {
-        if (!ctx.systemDb) {
-            throw new Error("resume-due-runs: ctx.systemDb required (r.systemScope() feature)");
-        }
-        const tenantId = ctx.systemUser?.tenantId ?? ctx._tenantId;
-        if (tenantId === undefined) {
-            // skip: cron fired without a perTenant fan-out tenant — nothing scoped
-            return;
-        }
-        const dueRows = await selectDueWorkflowRunPending(ctx.systemDb.assertTenantMatch(tenantId));
-        for (const row of dueRows) {
-            try {
-                await ctx.write("workflow-runner:write:resume-run", {
-                    runId: row.runId,
-                    stepIndex: row.stepIndex,
-                });
+export function createWorkflowRunnerFeature() {
+    return defineFeature(FEATURE_NAME, (r) => {
+        r.describe("Writes the run-envelope (`workflow.run-started` / `workflow.run-completed` / `workflow.run-failed`) for a workflow run onto its `workflow-run` aggregate stream. Provides `startAndRunWorkflow` and `registerEventTrigger` for consumer features to wire up `defineWorkflow`-based workflows against domain events. Registers no workflows itself. Runs the resume loop for suspended `wait`/`retry`/`waitForEvent` steps (`resume-due-runs` job + `resume-run` handler); `registerEventTrigger` wires an event-wakeup subscriber per workflow that declares `awaits` so a `waitForEvent` step resumes as soon as its awaited event arrives, not just on timeout.");
+        r.uiHints({
+            displayLabel: "Workflow Runner",
+            category: "infrastructure",
+            recommended: false,
+        });
+        // resume-run needs a full HandlerContext + ctx.systemDb (the pending-row
+        // scan crosses whatever tenant the row belongs to relative to the job's
+        // own tenant loop iteration) — same reasoning as tenant/feature.ts.
+        r.systemScope();
+        r.storeTable(workflowRunPendingTableMeta, {
+            reason: "resume_loop.pending_suspended_steps",
+        });
+        registerWorkflowRunPendingProjection(r);
+        r.writeHandler(resumeRunHandler);
+        r.job("resume-due-runs", { trigger: { cron: "* * * * *" }, perTenant: true, concurrency: "skip" }, async (_payload, ctx) => {
+            if (!ctx.systemDb) {
+                throw new Error("resume-due-runs: ctx.systemDb required (r.systemScope() feature)");
             }
-            catch (error) {
-                // skip: one row's dispatch failing (infra hiccup, not a business
-                // outcome — resume-run itself never throws for expected cases)
-                // must not stop the rest of this tenant's due rows from resuming.
-                ctx.log.warn(`[workflow-runner:resume-due-runs] runId=${row.runId} stepIndex=${row.stepIndex} dispatch failed: ${String(error)}`);
+            const tenantId = ctx.systemUser?.tenantId ?? ctx._tenantId;
+            if (tenantId === undefined) {
+                // skip: cron fired without a perTenant fan-out tenant — nothing scoped
+                return;
             }
-        }
-    });
-});
+            const dueRows = await selectDueWorkflowRunPending(ctx.systemDb.assertTenantMatch(tenantId));
+            for (const row of dueRows) {
+                try {
+                    await ctx.write("workflow-runner:write:resume-run", {
+                        runId: row.runId,
+                        stepIndex: row.stepIndex,
+                    });
+                }
+                catch (error) {
+                    // skip: one row's dispatch failing (infra hiccup, not a business
+                    // outcome — resume-run itself never throws for expected cases)
+                    // must not stop the rest of this tenant's due rows from resuming.
+                    ctx.log.warn(`[workflow-runner:resume-due-runs] runId=${row.runId} stepIndex=${row.stepIndex} dispatch failed: ${String(error)}`);
+                }
+            }
+        });
+    }, { dedupeOptions: {} });
+}
+/** @deprecated Use createWorkflowRunnerFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const workflowRunnerFeature = createWorkflowRunnerFeature();

package/dist/workflow-runner/handlers/resume-run.write.js

@@ -29,7 +29,7 @@
 // pipeline's result for the skipped waitForEvent step itself (see
 // resultKey on steps/wait-for-event.ts) — pre-seeded into stepsAcc below so
 // a subsequent step's resolver can read `ctx.steps[awaits.someKey]`.
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { buildPipelineSteps, computeDefinitionFingerprint, describeWorkflowStepError, getStep, runStepList, SYSTEM_ROLE, unwrapWorkflowStepError, WORKFLOW_AGGREGATE_TYPE, WORKFLOW_RESUMED_TYPE, WORKFLOW_RETRY_SCHEDULED_TYPE, WORKFLOW_RUN_COMPLETED_TYPE, WORKFLOW_RUN_FAILED_TYPE, WORKFLOW_RUN_STARTED_TYPE, WORKFLOW_WAITING_FOR_EVENT_TYPE, WorkflowStepError, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";

package/dist/workflow-runner/index.d.ts

@@ -1,4 +1,4 @@
 export { workflowRunAggregateId } from "./aggregate-id.js";
 export { registerEventTrigger } from "./event-trigger.js";
-export { workflowRunnerFeature } from "./feature.js";
+export { createWorkflowRunnerFeature, workflowRunnerFeature } from "./feature.js";
 export { startAndRunWorkflow, type WorkflowRunCompletedPayload, type WorkflowRunFailedPayload, type WorkflowRunStartedPayload, WorkflowSuspensionUnsupportedError, } from "./runner.js";

package/dist/workflow-runner/index.js

@@ -1,5 +1,5 @@
 // Public API of the workflow-runner bundled-feature.
 export { workflowRunAggregateId } from "./aggregate-id.js";
 export { registerEventTrigger } from "./event-trigger.js";
-export { workflowRunnerFeature } from "./feature.js";
+export { createWorkflowRunnerFeature, workflowRunnerFeature } from "./feature.js";
 export { startAndRunWorkflow, WorkflowSuspensionUnsupportedError, } from "./runner.js";

package/dist/workflow-runner/pending-projection.js

@@ -11,7 +11,7 @@
 // No resume logic here — framework#2513 Phase 2 owns the job that reads
 // this table and dispatches the actual resume. This projection only writes
 // the rows.
-import { deleteMany, fetchOne, upsertOnConflict } from "@cosmicdrift/kumiko-framework/bun-db";
+import { deleteMany, fetchOne, upsertOnConflict } from "@cosmicdrift/kumiko-framework/db";
 import { WORKFLOW_RESUMED_TYPE, WORKFLOW_RETRY_SCHEDULED_TYPE, WORKFLOW_RUN_COMPLETED_TYPE, WORKFLOW_RUN_FAILED_TYPE, WORKFLOW_WAITING_FOR_EVENT_TYPE, WORKFLOW_WAITING_TYPE, } from "@cosmicdrift/kumiko-framework/engine";
 import { workflowRunPendingTable } from "./tables.js";
 async function upsertPending(tx, row) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.367.0",
+  "version": "0.368.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -226,6 +226,10 @@
       "types": "./dist/file-provider-s3/index.d.ts",
       "default": "./dist/file-provider-s3/index.js"
     },
+    "./file-provider-s3/lib": {
+      "types": "./dist/file-provider-s3/lib/index.d.ts",
+      "default": "./dist/file-provider-s3/lib/index.js"
+    },
     "./document-ingest-foundation": {
       "types": "./dist/document-ingest-foundation/index.d.ts",
       "default": "./dist/document-ingest-foundation/index.js"
@@ -524,12 +528,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.367.0",
-    "@cosmicdrift/kumiko-framework": "0.367.0",
-    "@cosmicdrift/kumiko-headless": "0.367.0",
-    "@cosmicdrift/kumiko-renderer": "0.367.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.367.0",
-    "@cosmicdrift/kumiko-types": "0.367.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.368.0",
+    "@cosmicdrift/kumiko-framework": "0.368.0",
+    "@cosmicdrift/kumiko-headless": "0.368.0",
+    "@cosmicdrift/kumiko-renderer": "0.368.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.368.0",
+    "@cosmicdrift/kumiko-types": "0.368.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@tiptap/core": "3.31.3",
@@ -772,6 +776,10 @@
         "types": "./dist/file-provider-s3/index.d.ts",
         "default": "./dist/file-provider-s3/index.js"
       },
+      "./file-provider-s3/lib": {
+        "types": "./dist/file-provider-s3/lib/index.d.ts",
+        "default": "./dist/file-provider-s3/lib/index.js"
+      },
       "./document-ingest-foundation": {
         "types": "./dist/document-ingest-foundation/index.d.ts",
         "default": "./dist/document-ingest-foundation/index.js"
@@ -1078,10 +1086,19 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.367.0",
-    "@cosmicdrift/kumiko-locale-es": "0.367.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.367.0",
+    "@cosmicdrift/kumiko-locale-de": "0.368.0",
+    "@cosmicdrift/kumiko-locale-es": "0.368.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.368.0",
     "jsqr": "^1.4.0",
-    "unpdf": "^1.8.1"
+    "unpdf": "^1.8.1",
+    "@cosmicdrift/kumiko-testing": "0.368.0"
+  },
+  "peerDependencies": {
+    "@cosmicdrift/kumiko-testing": ">=0.366.0 <1.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@cosmicdrift/kumiko-testing": {
+      "optional": true
+    }
   }
 }

package/src/cap-counter/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.368.0",
+    "type": "improvement",
+    "title": "calendarCapReservationHandle consumes a reservation per unit",
+    "detail": "`reserveCalendarCapUsage` now returns `reservationId`. `calendarCapReservationHandle(ctx, reservationId, { capName, periodStartIso })` returns a handle with `consume(units)` (turns reserved units into booked ones, counter unchanged) and `release()` (gives back the unconsumed rest). A handler reserves the worst case before the job is dispatched, the job consumes per written unit, so parallel dispatches can no longer overshoot the hard cap and a retry only counts what was written.\n\n`consume` beyond the still-reserved rest throws `CapReservationOverConsumedError` (422, `cap_reservation_over_consumed`). `consume` against a settle tombstone throws `CapReservationSettledError` (422, `cap_reservation_settled`); `release` against it is a no-op. When the reservation outlived its TTL and was swept, `consume` books the units directly, the way settle does for a missing row, without a hard-cap check."
+  },
+  {
+    "version": "0.368.0",
+    "type": "fix",
+    "title": "Swept or released calendar reservations remember the units consume booked",
+    "detail": "The reservation row now stores `consumed_amount`. A release or the TTL sweep gives back only the unconsumed rest. If units were consumed, it keeps the row as a released tombstone (`released_at` set, `amount` 0) until the tombstone TTL passes, instead of deleting it. A later `settle` subtracts the consumed units from the booking, and a `consume` after the sweep books its units directly and is remembered the same way, so the counter ends at exactly the settled total. `settle` below the consumed units throws `CapSettleBelowConsumedError` (422, `cap_settle_below_consumed`) in every state. Expired released tombstones are deleted by the sweep.",
+    "migration": "Apps with cap-counter generate a migration for the new columns store_cap_reservations.consumed_amount (integer NOT NULL DEFAULT 0) and store_cap_reservations.released_at (kumiko migrate generate)."
+  },
   {
     "version": "0.366.0",
     "type": "fix",

package/src/crypto-shredding/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.368.0",
+    "type": "fix",
+    "title": "forget-subject closes the login door for users whose stream is already deleted",
+    "detail": "forget-subject returned 500 (\"user lifecycle update failed ... not_found\") when the user stream was deleted but the read_users status still read active, leaving sessions and PATs alive. The erasure now appends the status-deleted user.updated event to that stream too, so the login door closes, the handler returns 200 and a read_users rebuild keeps the state."
+  },
   {
     "version": "0.366.0",
     "type": "fix",

package/src/file-provider-s3/changes.json

@@ -1 +1,10 @@
-[]
+[
+  {
+    "version": "0.368.0",
+    "type": "breaking",
+    "title": "The S3 file providers merge into createFileProviderS3Feature({ fromEnv })",
+    "detail": "createFileProviderS3Feature() mounts the per-tenant config provider as before. createFileProviderS3Feature({ fromEnv: true }) mounts the env-configured provider (feature name, provider key \"s3-env\" and requires unchanged). The S3 client helpers (createS3Provider, createS3ProviderFromEnv, parseS3EnvConfig, resolveForcePathStyle, S3ProviderConfig) move to the new subpath @cosmicdrift/kumiko-bundled-features/file-provider-s3/lib.\n\nThe subpaths file-provider-s3-env and files-provider-s3 keep working as deprecated re-exports and are removed in the first release after 2026-10-29.\n\nold -> new:\n  fileProviderS3EnvFeature from .../file-provider-s3-env -> createFileProviderS3Feature({ fromEnv: true }) from .../file-provider-s3\n  fileProviderS3Feature -> createFileProviderS3Feature()\n  @cosmicdrift/kumiko-bundled-features/files-provider-s3 -> @cosmicdrift/kumiko-bundled-features/file-provider-s3/lib",
+    "migration": "Run `bun kumiko-upgrade --apply`. It rewrites the imports and the env feature mount, and reports `typeof fileProviderS3EnvFeature` and re-exports of it with file and line.",
+    "codemod": "scripts/codemod/s3-imports.ts"
+  }
+]

package/src/personal-access-tokens/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.368.0",
+    "type": "improvement",
+    "title": "The token list screen takes a description and slots via listScreen",
+    "detail": "createPersonalAccessTokensFeature({ listScreen: { description, slots } }) sets the i18n description and the slots (for example a header component) of the api-tokens list, so an app can show instructions above the list and use the bundled screen directly instead of embedding it in its own dashboard. Without the option nothing changes. Both bundled token screens are now marked agent: { expose: false }, since the mint screen reveals the token plaintext."
+  },
   {
     "version": "0.365.0",
     "type": "fix",

package/src/user/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.368.0",
+    "type": "fix",
+    "title": "Soft-deleted users no longer count as active principals",
+    "detail": "A user deleted through the entity executor keeps its last status (usually active) with isDeleted set. principalStatusPlugin, the session checker and the PAT role resolver only looked at the status, so existing sessions and tokens of such a user stayed valid. They now treat isDeleted as blocked (session \"blocked\", PAT 401, principal_blocked for membership resolution) through the new isPrincipalRowBlocked predicate."
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/dist/file-provider-s3-env/feature.d.ts

@@ -1,3 +0,0 @@
-export declare const fileProviderS3EnvFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
-    readonly exports: void;
-};

package/dist/file-provider-s3-env/feature.js

@@ -1,46 +0,0 @@
-// kumiko-feature-version: 1
-//
-// file-provider-s3-env — S3 file provider configured entirely from
-// process.env. ONE shared bucket for ALL tenants: wire it by setting the
-// `S3_*` env vars + mounting — no per-tenant admin seeding and no
-// `secrets`-feature dependency.
-//
-// **vs file-provider-s3:** the config-based `"s3"` provider owns per-tenant
-// config keys + an encrypted `s3.secretAccessKey` secret (per-tenant
-// buckets, admin-seeded). This `"s3-env"` provider reads one credential set
-// from env and serves every tenant from one bucket — the
-// Hetzner-Object-Storage / single-bucket deploy case. Tenant isolation
-// still holds: file keys carry the tenant (export ZIPs:
-// `exports/<tenantId>/<jobId>.zip`) or are globally-unique UUIDs (fileRefs).
-//
-// **Pattern-Vorbild:** mirrors file-provider-inmemory (zero admin seeding,
-// only the file-foundation plugin-point required).
-//
-// **Env vars** (read by createS3ProviderFromEnv, prefix `S3_`):
-//   required — S3_BUCKET, S3_REGION, S3_ACCESS_KEY, S3_SECRET_KEY
-//   optional — S3_ENDPOINT (S3-compat stores incl. Hetzner Object Storage),
-//              S3_FORCE_PATH_STYLE
-// Missing required vars throw on the FIRST file op (inside the export cron).
-// The user-data-rights boot guard surfaces that at boot instead.
-import { createS3ProviderFromEnv } from "@cosmicdrift/kumiko-bundled-features/files-provider-s3";
-import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
-const FEATURE_NAME = "file-provider-s3-env";
-export const fileProviderS3EnvFeature = defineFeature(FEATURE_NAME, (r) => {
-    r.describe('Registers an `"s3-env"` provider for `file-foundation` that reads one S3 credential set from `process.env` (`S3_BUCKET`/`S3_REGION`/`S3_ACCESS_KEY`/`S3_SECRET_KEY`, optional `S3_ENDPOINT`/`S3_FORCE_PATH_STYLE`) and serves every tenant from one shared bucket — no per-tenant config or secret seeding. Use this for single-bucket S3-compatible deploys (e.g. Hetzner Object Storage); use `file-provider-s3` instead when each tenant needs its own bucket/credentials.');
-    r.uiHints({
-        displayLabel: "File Provider · S3 (env)",
-        category: "storage",
-        recommended: false,
-    });
-    // No requires on "config" or "secrets" — credentials come from
-    // env, not the per-tenant config + secrets store. Only the file-foundation
-    // plugin-extension-point must be mounted.
-    r.requires({ features: ["file-foundation"] });
-    const plugin = {
-        // tenantId ignored: one shared bucket serves all tenants (isolation via
-        // tenant-prefixed / UUID keys). Built fresh per call like file-provider-s3;
-        // the S3 client opens no connection at construction.
-        build: async (_ctx, _tenantId) => createS3ProviderFromEnv(), // @wrapper-known semantic-alias
-    };
-    r.useExtension("fileProvider", "s3-env", plugin);
-});