@cosmicdrift/kumiko-bundled-features 0.367.0 → 0.368.0

package/dist/compliance-profiles-ops/index.js

@@ -11,18 +11,22 @@
 // per-tenant picker (the vast majority) stay unaffected.
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { tenantsMissingProfileQuery } from "./handlers/tenants-missing-profile.query.js";
-export const complianceProfilesOpsFeature = defineFeature("compliance-profiles-ops", (r) => {
-    r.describe("Platform-wide SystemAdmin counterpart to `compliance-profiles`' `needs-profile` query (#2089): `tenants-missing-profile` lists every enabled tenant with no row in `tenantComplianceProfile` at all, tenant-wide instead of scoped to the caller's own tenant. Mount alongside `compliance-profiles` and `tenant` when an operator UI needs to see which tenants still silently run on `minimal-no-region`.");
-    r.uiHints({
-        displayLabel: "Compliance Profiles · Operator Visibility",
-        category: "compliance",
-        recommended: false,
-    });
-    r.systemScope();
-    r.requires({ features: ["compliance-profiles"] });
-    r.requires({ features: ["tenant"] });
-    const queries = {
-        tenantsMissingProfile: r.queryHandler(tenantsMissingProfileQuery),
-    };
-    return { queries };
-});
+export function createComplianceProfilesOpsFeature() {
+    return defineFeature("compliance-profiles-ops", (r) => {
+        r.describe("Platform-wide SystemAdmin counterpart to `compliance-profiles`' `needs-profile` query (#2089): `tenants-missing-profile` lists every enabled tenant with no row in `tenantComplianceProfile` at all, tenant-wide instead of scoped to the caller's own tenant. Mount alongside `compliance-profiles` and `tenant` when an operator UI needs to see which tenants still silently run on `minimal-no-region`.");
+        r.uiHints({
+            displayLabel: "Compliance Profiles · Operator Visibility",
+            category: "compliance",
+            recommended: false,
+        });
+        r.systemScope();
+        r.requires({ features: ["compliance-profiles"] });
+        r.requires({ features: ["tenant"] });
+        const queries = {
+            tenantsMissingProfile: r.queryHandler(tenantsMissingProfileQuery),
+        };
+        return { queries };
+    }, { dedupeOptions: {} });
+}
+/** @deprecated Use createComplianceProfilesOpsFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const complianceProfilesOpsFeature = createComplianceProfilesOpsFeature();

package/dist/config/db/queries/resolver.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { configValuesTable } from "../../table.js";
 // Method-form so a tenant-mode TenantDb stays filtered. Two parallel selects
 // (disjoint via userId IS NULL) instead of one OR query: the buckets don't share

package/dist/config/handlers/reencrypt.job.js

@@ -84,7 +84,7 @@ export const reencryptJob = async (rawPayload, ctx) => {
     function tdbFor(tenantId) {
         let existing = tdbCache.get(tenantId);
         if (!existing) {
-            existing = createTenantDb(db, tenantId, "system");
+            existing = createTenantDb({ db, tenantId, mode: "system" });
             tdbCache.set(tenantId, existing);
         }
         return existing;
@@ -102,7 +102,7 @@ export const reencryptJob = async (rawPayload, ctx) => {
     // to acknowledge the cross-tenant scan below, never bound to a real
     // tenant's writes — sharing it with sdbFor(SYSTEM_TENANT_ID) would make a
     // write-path cache entry double as the scan's ack gate.
-    const scanDb = createSystemDbView(createTenantDb(db, SYSTEM_TENANT_ID, "system"), undefined, reportEscapeHatchFor(SYSTEM_TENANT_ID));
+    const scanDb = createSystemDbView(createTenantDb({ db, tenantId: SYSTEM_TENANT_ID, mode: "system" }), undefined, reportEscapeHatchFor(SYSTEM_TENANT_ID));
     let alreadyCurrent = 0;
     const targetVersion = provider.currentVersion();
     // ponytail: one full candidate scan — config rows are operator-scale

package/dist/config/resolver.js

@@ -1,6 +1,6 @@
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, decryptPiiValueForSubject, } from "@cosmicdrift/kumiko-framework/crypto";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { assertUnreachable, parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";

package/dist/config/write-helpers.js

@@ -1,7 +1,7 @@
 // Shared helpers for the config feature's write + query handlers.
 // Extracted from set.write.ts so reset.write.ts + values.query.ts don't
 // have to cross-import from another handler file.
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { ConfigScopes, extensionSelectorTargets, isEncryptedAtRest, SYSTEM_ROLE, SYSTEM_TENANT_ID, selectablePluginIds, } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, InternalError, NotFoundError, UnprocessableError, ValidationError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { assertUnreachable } from "@cosmicdrift/kumiko-framework/utils";

package/dist/crypto-shredding/handlers/forget-subject.write.js

@@ -1,8 +1,7 @@
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
-import { fetchOne, runInSavepointIfSupported, runnerCanBeginTransaction, transaction, } from "@cosmicdrift/kumiko-framework/bun-db";
 import { computeBlindIndex, configuredBlindIndexKey, configuredPiiSubjectKms, subjectIdSchema, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
-import { nullBlindIndexesForSubject, recordEventsOwnedExclusivelyByTenant, recordRowExistsInTenant, recordRowOwningTenantId, subjectRowExistsInTenant, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
+import { fetchOne, nullBlindIndexesForSubject, recordEventsOwnedExclusivelyByTenant, recordRowExistsInTenant, recordRowOwningTenantId, runInSavepointIfSupported, runnerCanBeginTransaction, subjectRowExistsInTenant, transaction, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, InternalError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { appendDomainEventCore, assertIrreversibleOperationAllowed, } from "@cosmicdrift/kumiko-framework/pipeline";
@@ -254,7 +253,11 @@ async function closeUserLoginDoor(ctx, userId, outsideRunner, handlerTxRunner) {
     if (!userRow)
         return;
     const closeDoor = async (runner) => {
-        await updateUserLifecycle(runner, userId, { status: USER_STATUS.Deleted }, { writePurpose: WritePurposes.erasure });
+        await updateUserLifecycle(runner, userId, { status: USER_STATUS.Deleted }, 
+        // includeDeleted: a user whose stream is already deleted but whose status
+        // still reads active would otherwise fail with not_found (500) and keep
+        // sessions and PATs alive.
+        { writePurpose: WritePurposes.erasure, includeDeleted: true });
         if (ctx.registry.features.has("personal-access-tokens")) {
             await revokeAllPatTokensForUser(runner, userId);
         }

package/dist/custom-fields/db/queries/field-access.js

@@ -1,4 +1,4 @@
-import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
+import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/db";
 export async function selectSerializedFieldDefinition(runner, tenantId, entityName, fieldKey) {
     const rows = await unsafeReadRetrying(runner, "SELECT serialized_field FROM read_custom_field_definitions WHERE entity_name = $1 AND field_key = $2 AND tenant_id = $3 LIMIT 1", [entityName, fieldKey, tenantId]);
     const first = rows[0]; // @cast-boundary db-row

package/dist/custom-fields/db/queries/projection.js

@@ -1,4 +1,4 @@
-import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/db";
 function quoteTable(tableName) {
     return `"${tableName.replace(/"/g, '""')}"`;
 }

package/dist/custom-fields/db/queries/quota.js

@@ -1,4 +1,4 @@
-import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
+import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/db";
 export async function countTenantFieldDefinitions(runner, tenantId) {
     // Active definitions only — delete soft-deletes (the deterministic stream is
     // kept so a re-define can restore it), so isDeleted rows must not consume quota.

package/dist/custom-fields/db/queries/retention.js

@@ -1,5 +1,4 @@
-import { asRawClient, unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
-import { toPostgresArrayLiteral } from "@cosmicdrift/kumiko-framework/db";
+import { asRawClient, toPostgresArrayLiteral, unsafeReadRetrying, } from "@cosmicdrift/kumiko-framework/db";
 export async function selectHostRowsWithCustomFields(db, tableName, tenantId) {
     const quoted = `"${tableName.replace(/"/g, '""')}"`;
     const rowsResult = await unsafeReadRetrying(db, `SELECT id, modified_at, custom_fields FROM ${quoted} WHERE tenant_id = $1 AND custom_fields IS NOT NULL`, [tenantId]);

package/dist/custom-fields/db/queries/user-data-rights.js

@@ -1,4 +1,4 @@
-import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
+import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/db";
 function quoteTable(tableName) {
     return `"${tableName.replace(/"/g, '""')}"`;
 }

package/dist/custom-fields/feature.d.ts

@@ -1,4 +1,4 @@
-export declare const customFieldsFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+declare const defaultCustomFieldsFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: {
         setEvent: import("@cosmicdrift/kumiko-types/handlers").EventDef<{
             fieldKey: string;
@@ -44,4 +44,22 @@ export type CustomFieldsFeatureOptions = {
     readonly fieldDefinitionWriteRoles?: readonly string[];
 };
 export declare function resolveFieldDefinitionListRoles(opts: Pick<CustomFieldsFeatureOptions, "valueWriteRoles" | "fieldDefinitionListRoles" | "fieldDefinitionWriteRoles">): readonly string[];
-export declare function createCustomFieldsFeature(opts?: CustomFieldsFeatureOptions): typeof customFieldsFeature;
+export declare function createCustomFieldsFeature(opts?: CustomFieldsFeatureOptions): typeof defaultCustomFieldsFeature;
+/** @deprecated Use createCustomFieldsFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export declare const customFieldsFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: {
+        setEvent: import("@cosmicdrift/kumiko-types/handlers").EventDef<{
+            fieldKey: string;
+            value?: unknown;
+        }, "custom-fields:event:custom-field-set">;
+        clearedEvent: import("@cosmicdrift/kumiko-types/handlers").EventDef<{
+            fieldKey: string;
+        }, "custom-fields:event:custom-field-cleared">;
+        fieldDefinitionDeletedEvent: import("@cosmicdrift/kumiko-types/handlers").EventDef<{
+            entityName: string;
+            fieldKey: string;
+            tenantId?: string | undefined;
+        }, "custom-fields:event:field-definition-deleted">;
+    };
+};
+export {};

package/dist/custom-fields/feature.js

@@ -33,7 +33,7 @@
 //   `customFieldsField()` (jsonb) deklarieren.
 //
 // **Exports-Pattern (2026-05-23 refactor)**:
-//   `customFieldsFeature.exports.{setEvent,clearedEvent,fieldDefinitionDeletedEvent}`
+//   `createCustomFieldsFeature().exports.{setEvent,clearedEvent,fieldDefinitionDeletedEvent}`
 //   liefern typed EventDef-handles. Handler + wire-for-entity nutzen
 //   `<event>.name` als compile-time-literal-typed qualified-string — keine
 //   hand-gebauten Template-Literals mehr (T1 hat den toKebab-collapse-drift
@@ -117,12 +117,9 @@ function registerCustomFields(r, variant) {
     }));
     return { setEvent, clearedEvent, fieldDefinitionDeletedEvent };
 }
-// Singleton feature-definition mit typed exports. Handler + wire-for-entity
-// importieren diesen `customFieldsFeature` und greifen lazy in ihrer
-// runtime-arrow-fn auf `.exports.<event>.name` zu — der module-cycle
-// (feature.ts -> handlers/*.write.ts -> feature.ts) löst sich auf weil
-// kein top-level-access stattfindet.
-export const customFieldsFeature = defineFeature(CUSTOM_FIELDS_FEATURE_NAME, (r) => registerCustomFields(r, {
+// Handlers and wire-for-entity read `.exports.<event>.name` lazily inside their runtime
+// arrow functions, which resolves the module cycle (feature.ts -> handlers/*.write.ts -> feature.ts).
+const defaultCustomFieldsFeature = defineFeature(CUSTOM_FIELDS_FEATURE_NAME, (r) => registerCustomFields(r, {
     defineTenantHandler: defineTenantFieldHandler,
     updateTenantHandler: updateTenantFieldHandler,
     deleteTenantHandler: deleteTenantFieldHandler,
@@ -146,18 +143,15 @@ export function resolveFieldDefinitionListRoles(opts) {
         ]),
     ];
 }
-// Backwards-compat-wrapper. Bestehende Caller (z.B. integration-tests,
-// host-apps) nutzen weiterhin `createCustomFieldsFeature()`. Returnt den
-// module-level-Singleton — kein neuer build pro Aufruf, was für consumer
-// nicht erkennbar ist (read-only inspection). Jede gesetzte Option baut
-// eine frische Feature-Definition mit den Varianten-Handlern.
+// Without options this returns the module-level singleton (no rebuild per call); every
+// option builds a fresh feature definition with the variant handlers.
 export function createCustomFieldsFeature(opts = {}) {
     const hasOptions = opts.fieldDefinitionLimitPerTenant !== undefined ||
         opts.valueWriteRoles !== undefined ||
         opts.fieldDefinitionListRoles !== undefined ||
         opts.fieldDefinitionWriteRoles !== undefined;
     if (!hasOptions) {
-        return customFieldsFeature;
+        return defaultCustomFieldsFeature;
     }
     const limit = opts.fieldDefinitionLimitPerTenant;
     const definitionWriteRoles = opts.fieldDefinitionWriteRoles;
@@ -179,3 +173,5 @@ export function createCustomFieldsFeature(opts = {}) {
         fieldDefinitionListRoles: resolveFieldDefinitionListRoles(opts),
     }));
 }
+/** @deprecated Use createCustomFieldsFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const customFieldsFeature = createCustomFieldsFeature();

package/dist/custom-fields/handlers/clear-custom-field.write.js

@@ -1,7 +1,7 @@
 import { failNotFound, failUnprocessable } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { DEFAULT_VALUE_WRITE_ROLES } from "../constants.js";
-import { customFieldsFeature } from "../feature.js";
+import { createCustomFieldsFeature } from "../feature.js";
 import { checkFieldAccessForWrite } from "../lib/field-access.js";
 export const clearCustomFieldPayloadSchema = z.object({
     entityName: z.string().min(1).max(64),
@@ -47,7 +47,7 @@ export const clearCustomFieldHandler = {
         await ctx.unsafeAppendEvent({
             aggregateId: payload.entityId,
             aggregateType: payload.entityName,
-            type: customFieldsFeature.exports.clearedEvent.name,
+            type: createCustomFieldsFeature().exports.clearedEvent.name,
             payload: { fieldKey: payload.fieldKey },
         });
         return {

package/dist/custom-fields/handlers/delete-system-field.write.js

@@ -3,7 +3,7 @@ import { requireForTenant } from "../../shared/index.js";
 import { fieldDefinitionAggregateId } from "../aggregate-id.js";
 import { FIELD_DEFINITION_AGGREGATE_TYPE } from "../constants.js";
 import { fieldDefinitionExecutor } from "../executor.js";
-import { customFieldsFeature } from "../feature.js";
+import { createCustomFieldsFeature } from "../feature.js";
 import { deleteFieldPayloadSchema } from "../schemas.js";
 // delete-system-field — SystemAdmin entfernt eine system-weite Field-
 // Definition. Konsequenz: KEIN Tenant kann mehr neue Werte dafür setzen,
@@ -29,7 +29,7 @@ export const deleteSystemFieldHandler = {
             await ctx.unsafeAppendEvent({
                 aggregateId,
                 aggregateType: FIELD_DEFINITION_AGGREGATE_TYPE,
-                type: customFieldsFeature.exports.fieldDefinitionDeletedEvent.name,
+                type: createCustomFieldsFeature().exports.fieldDefinitionDeletedEvent.name,
                 payload: {
                     entityName: payload.entityName,
                     fieldKey: payload.fieldKey,

package/dist/custom-fields/handlers/delete-tenant-field.write.js

@@ -2,7 +2,7 @@ import { isSystemTenant } from "@cosmicdrift/kumiko-framework/engine";
 import { fieldDefinitionAggregateId } from "../aggregate-id.js";
 import { DEFAULT_FIELD_DEFINITION_WRITE_ROLES, FIELD_DEFINITION_AGGREGATE_TYPE, } from "../constants.js";
 import { fieldDefinitionExecutor } from "../executor.js";
-import { customFieldsFeature } from "../feature.js";
+import { createCustomFieldsFeature } from "../feature.js";
 import { deleteFieldPayloadSchema } from "../schemas.js";
 export function createDeleteTenantFieldHandler(opts = {}) {
     return {
@@ -26,7 +26,7 @@ export function createDeleteTenantFieldHandler(opts = {}) {
                 await ctx.unsafeAppendEvent({
                     aggregateId,
                     aggregateType: FIELD_DEFINITION_AGGREGATE_TYPE,
-                    type: customFieldsFeature.exports.fieldDefinitionDeletedEvent.name,
+                    type: createCustomFieldsFeature().exports.fieldDefinitionDeletedEvent.name,
                     payload: { entityName: payload.entityName, fieldKey: payload.fieldKey, tenantId },
                 });
             }

package/dist/custom-fields/handlers/set-custom-field.write.js

@@ -1,7 +1,7 @@
 import { failNotFound, failUnprocessable } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { DEFAULT_VALUE_WRITE_ROLES } from "../constants.js";
-import { customFieldsFeature } from "../feature.js";
+import { createCustomFieldsFeature } from "../feature.js";
 import { fieldWriteAccessDeniedRoles, loadFieldDefinition } from "../lib/field-access.js";
 import { buildCustomFieldValueSchema } from "../lib/value-schema.js";
 export const setCustomFieldPayloadSchema = z.object({
@@ -87,7 +87,7 @@ export const setCustomFieldHandler = {
         await ctx.unsafeAppendEvent({
             aggregateId: payload.entityId,
             aggregateType: payload.entityName,
-            type: customFieldsFeature.exports.setEvent.name,
+            type: createCustomFieldsFeature().exports.setEvent.name,
             payload: { fieldKey: payload.fieldKey, value: payload.value },
         });
         return {

package/dist/custom-fields/wire-for-entity.js

@@ -2,7 +2,7 @@ import { extractTableName } from "@cosmicdrift/kumiko-framework/db";
 import { createJsonbField, isSystemTenant, } from "@cosmicdrift/kumiko-framework/engine";
 import { CUSTOM_FIELDS_EXTENSION, FIELD_DEFINITION_AGGREGATE_TYPE } from "./constants.js";
 import { clearCustomFieldKey, removeCustomFieldKeyForTenant, removeCustomFieldKeyFromAllTenants, setCustomFieldValue, } from "./db/queries/projection.js";
-import { customFieldsFeature } from "./feature.js";
+import { createCustomFieldsFeature } from "./feature.js";
 // Helper für entity-definitions — fügt eine `customFields jsonb`-Spalte
 // hinzu. Consumer:
 //
@@ -69,9 +69,9 @@ export function wireCustomFieldsFor(r, entityName, entityTable) {
     // Qualified event-type-names — sourced from typed EventDef.name handles
     // (compile-time literal-typed, no Template-Literal-Drift à la toKebab-
     // collapse-bug die T1 aufgedeckt hat).
-    const setEventType = customFieldsFeature.exports.setEvent.name;
-    const clearedEventType = customFieldsFeature.exports.clearedEvent.name;
-    const fieldDefDeletedType = customFieldsFeature.exports.fieldDefinitionDeletedEvent.name;
+    const setEventType = createCustomFieldsFeature().exports.setEvent.name;
+    const clearedEventType = createCustomFieldsFeature().exports.clearedEvent.name;
+    const fieldDefDeletedType = createCustomFieldsFeature().exports.fieldDefinitionDeletedEvent.name;
     // Geteilte apply-Bodies: die MSP liefert sie live (async cursor), die
     // entity-projection-extension replayt sie in rebuildProjection — gleiche
     // SQL-Helper, beide idempotent. 2-Param-Signatur ist die gemeinsame

package/dist/data-retention/resolve-for-tenant.js

@@ -1,7 +1,7 @@
 // Single implementation of the three-layer policy resolution: the cleanup cron,
 // the forget runner and the `policy-for` query all go through here, so a caller
 // cannot skip a layer (e.g. the tenant preset) by accident.
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { isTenantDb } from "../shared/index.js";
 import { parseRetentionOverrideOrNull } from "./_internal/parse-override.js";
 import { resolveTenantRetentionPreset } from "./resolve-tenant-preset.js";

package/dist/data-retention/run-retention-cleanup.js

@@ -37,9 +37,8 @@
 // taegliche Re-Lauf appended also null Events. Der WHERE matcht anonymisierte
 // Rows weiter (reference bleibt alt), deshalb id-Cursor-Paging statt einer
 // einzelnen Page — sonst verstopfen erledigte Rows das batchLimit-Fenster.
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { collectPiiSubjectFields, configuredPiiSubjectKms, isSelfPiiField, resolveSubjectForField, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
-import { createEventStoreExecutor, createTenantDb, nullBlindIndexesForSubject, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
+import { collectPiiSubjectFields, configuredPiiSubjectKms, isRecordKeyedField, isSelfPiiField, resolveSubjectForField, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
+import { createEventStoreExecutor, createTenantDb, nullBlindIndexesForSubject, selectMany, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
 import { deleteFileRefBytes } from "@cosmicdrift/kumiko-framework/derivatives";
 import { createSystemUser, entityHasAnonymizableSubjectField, } from "@cosmicdrift/kumiko-framework/engine";
 import { fileRefEntity, fileRefsTable, } from "@cosmicdrift/kumiko-framework/files";
@@ -81,24 +80,29 @@ async function purgeMatchingRows(db, table, where, batchLimit, op) {
 // (purgeMatchingRows's hardDelete select) is enough; the with-files path's
 // full row works the same way.
 //
-// userOwned/tenantOwned are explicitly excluded: hardDelete only destroys
+// userOwned/tenantOwned are explicitly excluded (except a whenAbsent: "self" field
+// of an ownerless row, which resolves to this row's own record key): hardDelete only destroys
 // THIS row's own data, but the owning user's/tenant's key may still protect
 // OTHER live rows that reference the same subject — erasing it here would
 // be a silent cross-row data-loss bug, not a retention fix.
+function mayResolveToOwnRecordKey(field) {
+    if ("tenantOwned" in field && field.tenantOwned === true)
+        return false;
+    if ("userOwned" in field && field.userOwned !== undefined)
+        return isRecordKeyedField(field);
+    return ("recordOwned" in field && field.recordOwned === true) || isSelfPiiField(field);
+}
 function collectHardDeleteEraseSubjects(entity, entityName, tenantId, row) {
     const subjectsByKey = new Map();
     for (const fieldName of collectPiiSubjectFields(entity)) {
         const field = entity.fields[fieldName];
-        if (!field)
+        if (!field || !mayResolveToOwnRecordKey(field))
             continue;
-        const isRecordOwned = "recordOwned" in field && field.recordOwned === true;
+        const subject = resolveSubjectForField(entity, fieldName, row, { tenantId, entityName });
+        // whenAbsent: "self" resolves to the owner's key while the row has an owner — never erased here
         const isUserOwned = "userOwned" in field && field.userOwned !== undefined;
-        const isTenantOwned = "tenantOwned" in field && field.tenantOwned === true;
-        if (isUserOwned || isTenantOwned)
-            continue; // never erase — see header comment
-        if (!isRecordOwned && !isSelfPiiField(field))
+        if (isUserOwned && subject?.kind !== "record")
             continue;
-        const subject = resolveSubjectForField(entity, fieldName, row, { tenantId, entityName });
         if (subject)
             subjectsByKey.set(subjectIdToKey(subject), subject);
     }
@@ -132,7 +136,7 @@ async function eraseHardDeletedRowKeys(args) {
 // unconfined and leave the row gone with its key still live.
 async function forgetRowAndEraseKeys(args) {
     return runInSubTransaction(args.db, async (sp) => {
-        const tdb = createTenantDb(sp, args.tenantId, "system");
+        const tdb = createTenantDb({ db: sp, tenantId: args.tenantId, mode: "system" });
         const result = await args.executor.forget({ id: args.row["id"] }, args.systemUser, tdb);
         if (!result.isSuccess)
             return { isSuccess: false };
@@ -445,7 +449,7 @@ export async function runRetentionCleanup(args) {
     // the daily cron converges (hardDelete removes rows, softDelete's isDeleted
     // filter shrinks the set). A single batched forget/delete event is a follow-up.
     const systemUser = createSystemUser(tenantId);
-    const tdb = createTenantDb(db, tenantId, "system");
+    const tdb = createTenantDb({ db, tenantId, mode: "system" });
     const fileHolders = collectSingleFileHolders(registry);
     // Pre-load every override row for this tenant ONCE — N entities × M
     // tenants would otherwise mean one fetchOne per entity per tenant, even

package/dist/delivery/address-opt-out.js

@@ -1,6 +1,5 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { computeBlindIndex, configuredBlindIndexKey } from "@cosmicdrift/kumiko-framework/crypto";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, fetchOne, } from "@cosmicdrift/kumiko-framework/db";
 import { ConflictError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { generateDeterministicId } from "@cosmicdrift/kumiko-framework/utils";
 import { DeliveryErrors } from "./public-names.js";

package/dist/delivery/attempt-log-retention.js

@@ -1,4 +1,4 @@
-import { deleteManyBatched } from "@cosmicdrift/kumiko-framework/bun-db";
+import { deleteManyBatched } from "@cosmicdrift/kumiko-framework/db";
 import { pruneEvents } from "@cosmicdrift/kumiko-framework/pipeline";
 import { deliveryAttemptsTable } from "./tables.js";
 export const DEFAULT_ATTEMPT_LOG_RETENTION_DAYS = 90;

package/dist/delivery/channel-context.js

@@ -87,7 +87,7 @@ export function createEmailAttachmentReader(db, registry, tenantId, config, file
 // and it never runs through a job).
 export function buildChannelContext(db, registry, sseBroker, tenantId, secrets, tenantConfig, filesForTenant) {
     return {
-        db: createTenantDb(db, tenantId),
+        db: createTenantDb({ db, tenantId }),
         registry,
         sseBroker,
         tenantId,

package/dist/delivery/db/queries/address-opt-outs.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { notificationAddressOptOutsTable } from "../../tables.js";
 export function addressOptOutKey(addressHash, channel) {
     return `${addressHash}|${channel}`;

package/dist/delivery/db/queries/preferences.js

@@ -1,4 +1,4 @@
-import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
+import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/db";
 // @wrapper-known semantic-alias
 export async function selectNotificationPreferences(db, tenantId, userId, notificationTypeNames, channelName) {
     return unsafeReadRetrying(db, `SELECT notification_type AS "notificationType", channel, enabled

package/dist/delivery/delivery-service.js

@@ -1,8 +1,7 @@
 import { createSystemDbView, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
-import { assertNotificationVariables, createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
+import { assertNotificationVariables, bridgeStub, createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { assertNotifyTargetsOwnTenant, createEscapeHatchReporter, } from "@cosmicdrift/kumiko-framework/pipeline";
-import { bridgeStub } from "@cosmicdrift/kumiko-framework/testing/handler-context";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { fileContextFromResolver } from "../file-foundation/index.js";
 import { redactErrorText } from "../shared/index.js";
@@ -125,17 +124,27 @@ export function createDeliveryService(options) {
         // path a cross-tenant read the dispatcher never allows. Cross-tenant reach only
         // exists through the grant-carrying systemDb view below.
         const isSystem = registry.isHandlerSystemScoped(tenantUserIdsQuery);
-        const tenantDb = createTenantDb(run.db, tenantId, "tenant", undefined, undefined, undefined, {
-            report,
+        const tenantDb = createTenantDb({
+            db: run.db,
+            tenantId,
+            mode: "tenant",
+            grants: {
+                report,
+            },
         });
         // The dispatcher grants a systemScope handler's ctx.systemDb.unsafeRaw() ungated —
         // the grant comes from the handler's own r.systemScope() registration, not from this
         // caller. Only the systemDb view's own source TenantDb carries the grant, so it
         // can't leak onto ctx.db.
         const systemDbSourceTenantDb = isSystem
-            ? createTenantDb(run.db, tenantId, "system", undefined, undefined, undefined, {
-                report,
-                unsafeRaw: { reason: `r.systemScope() handler "${tenantUserIdsQuery}"` },
+            ? createTenantDb({
+                db: run.db,
+                tenantId,
+                mode: "system",
+                grants: {
+                    report,
+                    unsafeRaw: { reason: `r.systemScope() handler "${tenantUserIdsQuery}"` },
+                },
             })
             : undefined;
         // Hand-built context, not routed through the dispatcher — this needs both

package/dist/delivery/feature.js

@@ -1,4 +1,4 @@
-import { updateMany, upsertByPk } from "@cosmicdrift/kumiko-framework/bun-db";
+import { updateMany, upsertByPk } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineFeature, i18nKey, } from "@cosmicdrift/kumiko-framework/engine";
 import { ConsumerLagError } from "@cosmicdrift/kumiko-framework/pipeline";
 import { resolveAttemptLogRetentionDays, runAttemptLogRetention } from "./attempt-log-retention.js";

package/dist/delivery/handlers/log.query.js

@@ -1,5 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { decodeKeysetCursor, encodeKeysetCursor, } from "@cosmicdrift/kumiko-framework/db";
+import { decodeKeysetCursor, encodeKeysetCursor, selectMany, } from "@cosmicdrift/kumiko-framework/db";
 import { access, definePagedQueryHandler, isDeliveryErrorCode, isUuid, MAX_LIST_LIMIT, SYSTEM_USER_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
@@ -30,7 +29,7 @@ function isDeliveryLogSortField(value) {
     return value in DELIVERY_LOG_SORT_COLUMNS;
 }
 // createdAt round-trips through Temporal.Instant (matches how the WHERE
-// builder coerces timestamptz values — see bun-db/query.ts prepareValue);
+// builder coerces timestamptz values — see db/query.ts prepareValue);
 // every other whitelisted column is a plain text column. Keyed by the
 // PHYSICAL column, not the display alias — row only has the DB field names
 // (e.g. notificationType), never the alias (e.g. "type").

package/dist/delivery/handlers/preferences.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/dist/delivery/upsert-preference.js

@@ -12,8 +12,7 @@
 // loser's create() comes back as a `version_conflict` failure; re-lookup and
 // fall through to update, or no-op if the winner already set the target
 // `enabled` state.
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, fetchOne, } from "@cosmicdrift/kumiko-framework/db";
 import { generateDeterministicId } from "@cosmicdrift/kumiko-framework/utils";
 import { notificationPreferenceEntity, notificationPreferencesTable } from "./tables.js";
 const executor = createEventStoreExecutor(notificationPreferencesTable, notificationPreferenceEntity, { entityName: "notification-preference" });

package/dist/derivatives-sharp/feature.d.ts

@@ -1,3 +1,7 @@
+export declare function createDerivativesSharpFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: void;
+};
+/** @deprecated Use createDerivativesSharpFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const derivativesSharpFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };

package/dist/derivatives-sharp/feature.js

@@ -2,14 +2,18 @@
 import { defineFeature, EXT_DERIVATIVE_RENDERER } from "@cosmicdrift/kumiko-framework/engine";
 import { renderImage } from "./render.js";
 const FEATURE_NAME = "derivatives-sharp";
-export const derivativesSharpFeature = defineFeature(FEATURE_NAME, (r) => {
-    r.describe("Registers an `image/*` renderer against the `derivativeRenderer` extension point declared by `file-derivatives`, backed by sharp. Supports resize/fit (cover, inside, contain), format conversion with quality (webp, avif, jpeg), whole-image blur, and blurring individual regions burned in before resize (see BlurRegion). EXIF orientation is applied and then normalized away, and all other EXIF (including GPS) is dropped. Server-only: sharp is a native binding — never import this from client code.");
-    r.uiHints({
-        displayLabel: "File Derivatives · Sharp",
-        category: "storage",
-        recommended: false,
-    });
-    r.requires({ features: ["file-derivatives"] });
-    const plugin = { render: renderImage };
-    r.useExtension(EXT_DERIVATIVE_RENDERER, "image/*", plugin);
-});
+export function createDerivativesSharpFeature() {
+    return defineFeature(FEATURE_NAME, (r) => {
+        r.describe("Registers an `image/*` renderer against the `derivativeRenderer` extension point declared by `file-derivatives`, backed by sharp. Supports resize/fit (cover, inside, contain), format conversion with quality (webp, avif, jpeg), whole-image blur, and blurring individual regions burned in before resize (see BlurRegion). EXIF orientation is applied and then normalized away, and all other EXIF (including GPS) is dropped. Server-only: sharp is a native binding — never import this from client code.");
+        r.uiHints({
+            displayLabel: "File Derivatives · Sharp",
+            category: "storage",
+            recommended: false,
+        });
+        r.requires({ features: ["file-derivatives"] });
+        const plugin = { render: renderImage };
+        r.useExtension(EXT_DERIVATIVE_RENDERER, "image/*", plugin);
+    }, { dedupeOptions: {} });
+}
+/** @deprecated Use createDerivativesSharpFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const derivativesSharpFeature = createDerivativesSharpFeature();

package/dist/derivatives-sharp/index.d.ts

@@ -1,2 +1,2 @@
-export { derivativesSharpFeature } from "./feature.js";
+export { createDerivativesSharpFeature, derivativesSharpFeature } from "./feature.js";
 export { imageMetadata } from "./render.js";

package/dist/derivatives-sharp/index.js

@@ -1,2 +1,2 @@
-export { derivativesSharpFeature } from "./feature.js";
+export { createDerivativesSharpFeature, derivativesSharpFeature } from "./feature.js";
 export { imageMetadata } from "./render.js";

package/dist/document-ingest-foundation/feature.d.ts

@@ -1,3 +1,10 @@
+export declare function createDocumentIngestFoundationFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: {
+        ocrLanguageConfigKey: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"text">;
+        maxPagesPerFileConfigKey: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"number">;
+    };
+};
+/** @deprecated Use createDocumentIngestFoundationFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const documentIngestFoundationFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: {
         ocrLanguageConfigKey: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"text">;