@cosmicdrift/kumiko-bundled-features 0.367.0 → 0.368.0

package/dist/inbound-mail-foundation/feature.js

@@ -54,151 +54,155 @@ import { updateAccountHandler } from "./handlers/update-account.write.js";
 import { applyInboundMessageReceived, applyMailAccountConnected, applyMailAccountDisconnected, applyMailAccountUpdated, applyMailThreadUpdated, inboundMessagesProjectionTable, mailAccountsProjectionTable, mailThreadsProjectionTable, } from "./projection.js";
 import { runInboundMailRetention } from "./retention-sweep.js";
 import { INBOUND_MAIL_TENANT_DESTROY_ARCHIVE_REASON, inboundMessageTenantDestroyHook, mailAccountTenantDestroyHook, mailThreadTenantDestroyHook, } from "./tenant-destroy-hook.js";
-export const inboundMailFoundationFeature = defineFeature(INBOUND_MAIL_FOUNDATION_FEATURE, (r) => {
-    r.describe("Plugin host for inbound e-mail (inbox federation) — provider plugins (inbound-provider-imap, later M365 Graph / Gmail REST) register at the `inboundMailProvider` extension point with verify/fetch and optional oauth/watch (live push). The foundation owns three event-sourced streams (mail-account lifecycle, inbound-message with exactly-once ingest via deterministic aggregate ids, mail-thread rollup) and their projections `read_mail_accounts`/`read_inbound_messages`/`read_mail_threads`; PII fields are envelope-encrypted per tenant subject key before every append (crypto-shredding on tenant destroy). Wire `createInboundMailConnectRoutes` (OAuth connect + anonymous callback outside /api) and `createInboundMailSupervisor` (IDLE watch with backoff + reconciliation poll) in bin/server.ts. Consume `inbound-mail-foundation:event:inbound-message-received` from app features to attach business processes.");
-    r.uiHints({
-        displayLabel: "Inbound Mail · Foundation",
-        category: "notifications",
-        recommended: false,
-    });
-    // EXT_TENANT_DATA-Hook braucht den tenant-lifecycle-Host.
-    r.requires({ features: ["tenant-lifecycle"] });
-    // 5 fine-grained domain-events (Payload-Schemas: events.ts).
-    // piiFields: "none" — address/subject/snippet are already ciphertext under the tenant subject key before append (see events.ts).
-    // "displayName" stays plaintext (often the mailbox owner's real name for
-    // personal accounts); encrypting it would break the entity-projection read
-    // path that carries it as `personal: false`.
-    r.defineEvent(MAIL_ACCOUNT_CONNECTED_EVENT_SHORT, mailAccountEventPayloadSchema, {
-        piiFields: "none",
-    });
-    r.defineEvent(MAIL_ACCOUNT_UPDATED_EVENT_SHORT, mailAccountEventPayloadSchema, {
-        piiFields: "none",
-    });
-    r.defineEvent(MAIL_ACCOUNT_DISCONNECTED_EVENT_SHORT, mailAccountEventPayloadSchema, {
-        piiFields: "none",
-    });
-    r.defineEvent(INBOUND_MESSAGE_RECEIVED_EVENT_SHORT, inboundMessageEventPayloadSchema, {
-        piiFields: "none",
-    });
-    r.defineEvent(MAIL_THREAD_UPDATED_EVENT_SHORT, mailThreadEventPayloadSchema, {
-        piiFields: "none",
-    });
-    // Inline projections — apply in derselben TX wie der Append.
-    r.projection({
-        name: "mail-account",
-        source: MAIL_ACCOUNT_AGGREGATE_TYPE,
-        table: mailAccountsProjectionTable,
-        entity: mailAccountEntity,
-        apply: {
-            [MAIL_ACCOUNT_CONNECTED_EVENT_QN]: applyMailAccountConnected,
-            [MAIL_ACCOUNT_UPDATED_EVENT_QN]: applyMailAccountUpdated,
-            [MAIL_ACCOUNT_DISCONNECTED_EVENT_QN]: applyMailAccountDisconnected,
-        },
-    });
-    r.projection({
-        name: "inbound-message",
-        source: INBOUND_MESSAGE_AGGREGATE_TYPE,
-        table: inboundMessagesProjectionTable,
-        entity: inboundMessageEntity,
-        apply: {
-            [INBOUND_MESSAGE_RECEIVED_EVENT_QN]: applyInboundMessageReceived,
-        },
-    });
-    r.projection({
-        name: "mail-thread",
-        source: MAIL_THREAD_AGGREGATE_TYPE,
-        table: mailThreadsProjectionTable,
-        entity: mailThreadEntity,
-        apply: {
-            [MAIL_THREAD_UPDATED_EVENT_QN]: applyMailThreadUpdated,
-        },
-    });
-    // Plugin extension-point — Provider registrieren sich via
-    // r.useExtension("inboundMailProvider", "<key>", plugin).
-    r.extendsRegistrar(INBOUND_MAIL_PROVIDER_EXTENSION, {
-        onRegister: () => {
-            // No side-effects at register-time — Lookup läuft zur Laufzeit
-            // über resolveInboundProviderForKey/-Account.
-        },
-    });
-    // Sync-Maschinerie: hochfrequenter Tick-State, bewusst NICHT
-    // event-sourced — r.storeTable hält die Migration-DDL, nimmt die
-    // Tabellen aber aus dem Projection-Rebuild (#494/#498-Klasse).
-    r.storeTable(syncCursorTable, {
-        reason: "read_side.mail_sync_cursors_direct_write",
-    });
-    r.storeTable(seenMessageTable, {
-        reason: "read_side.mail_seen_messages_direct_write",
-    });
-    // Write-Handler:
-    //   - ingest-message: programmatic (Supervisor/Poll, SystemAdmin)
-    //   - connect/update/disconnect-account: Lifecycle
-    r.writeHandler(ingestMessageHandler);
-    r.writeHandler(connectAccountHandler);
-    r.writeHandler(updateAccountHandler);
-    r.writeHandler(disconnectAccountHandler);
-    // List-Queries (PII-decrypted, scope-gefiltert).
-    r.queryHandler(listAccountsQuery);
-    r.queryHandler(listMessagesQuery);
-    // Entity-genaue GDPR-Destroy-Hooks — der gdpr-storage-Boot-Validator
-    // prueft die EXT_TENANT_DATA-Registrierung pro tenant-subject-Entity.
-    r.useExtension(EXT_TENANT_DATA, "mail-account", {
-        destroy: mailAccountTenantDestroyHook,
-        escapeHatch: { reason: INBOUND_MAIL_TENANT_DESTROY_ARCHIVE_REASON },
-    });
-    r.useExtension(EXT_TENANT_DATA, "inbound-message", {
-        destroy: inboundMessageTenantDestroyHook,
-        escapeHatch: { reason: INBOUND_MAIL_TENANT_DESTROY_ARCHIVE_REASON },
-    });
-    r.useExtension(EXT_TENANT_DATA, "mail-thread", {
-        destroy: mailThreadTenantDestroyHook,
-        escapeHatch: { reason: INBOUND_MAIL_TENANT_DESTROY_ARCHIVE_REASON },
-    });
-    // Data-Retention (#957) — perTenant fan-out (one run per tenant, like
-    // data-retention:retention-cleanup): runInboundMailRetention's raw query
-    // helpers need the unfiltered runner, so the handler declares escapeHatch
-    // and reaches for ctx.db.unsafeRaw(). Without this cron, read_inbound_messages
-    // + the bodies grow unbounded (GDPR Art. 5).
-    const INBOUND_MAIL_RETENTION_REASON = "inbound-mail retention runs raw deletes; every statement filters by this run's tenantId";
-    r.job({
-        name: "inbound-mail-retention",
-        trigger: { cron: "0 3 * * *" },
-        perTenant: true,
-        concurrency: "skip",
-        escapeHatch: { reason: INBOUND_MAIL_RETENTION_REASON },
-        handler: async (_payload, ctx) => {
-            if (!ctx.registry) {
-                throw new Error("inbound-mail-retention: ctx.registry required (JobContext incomplete)");
-            }
-            const tenantId = ctx.systemUser?.tenantId ?? ctx._tenantId;
-            if (tenantId === undefined) {
-                // skip: cron fired without a perTenant fan-out tenant — nothing scoped
-                return;
-            }
-            const T = (await import("@cosmicdrift/kumiko-framework/time")).getTemporal();
-            const retentionDb = ctx.db.unsafeRaw(); // @cast-boundary db-operator — jobs never run inside a DbTx
-            // Body-Objekte liegen in file-foundation. Provider lazy + memoized —
-            // heute schreibt der Ingest kein bodyRef (storeBody-Hook ungebunden),
-            // der Provider wird also nie gebaut. Sobald storeBody wired ist, raeumt
-            // die Retention die Bodies mit ab.
-            let providerPromise = null;
-            const deleteBodyObject = async (bodyRef) => {
-                if (!providerPromise) {
-                    providerPromise = createFileProviderForTenant({ config: ctx.config, registry: ctx.registry }, tenantId);
+export function createInboundMailFoundationFeature() {
+    return defineFeature(INBOUND_MAIL_FOUNDATION_FEATURE, (r) => {
+        r.describe("Plugin host for inbound e-mail (inbox federation) — provider plugins (inbound-provider-imap, later M365 Graph / Gmail REST) register at the `inboundMailProvider` extension point with verify/fetch and optional oauth/watch (live push). The foundation owns three event-sourced streams (mail-account lifecycle, inbound-message with exactly-once ingest via deterministic aggregate ids, mail-thread rollup) and their projections `read_mail_accounts`/`read_inbound_messages`/`read_mail_threads`; PII fields are envelope-encrypted per tenant subject key before every append (crypto-shredding on tenant destroy). Wire `createInboundMailConnectRoutes` (OAuth connect + anonymous callback outside /api) and `createInboundMailSupervisor` (IDLE watch with backoff + reconciliation poll) in bin/server.ts. Consume `inbound-mail-foundation:event:inbound-message-received` from app features to attach business processes.");
+        r.uiHints({
+            displayLabel: "Inbound Mail · Foundation",
+            category: "notifications",
+            recommended: false,
+        });
+        // EXT_TENANT_DATA-Hook braucht den tenant-lifecycle-Host.
+        r.requires({ features: ["tenant-lifecycle"] });
+        // 5 fine-grained domain-events (Payload-Schemas: events.ts).
+        // piiFields: "none" — address/subject/snippet are already ciphertext under the tenant subject key before append (see events.ts).
+        // "displayName" stays plaintext (often the mailbox owner's real name for
+        // personal accounts); encrypting it would break the entity-projection read
+        // path that carries it as `personal: false`.
+        r.defineEvent(MAIL_ACCOUNT_CONNECTED_EVENT_SHORT, mailAccountEventPayloadSchema, {
+            piiFields: "none",
+        });
+        r.defineEvent(MAIL_ACCOUNT_UPDATED_EVENT_SHORT, mailAccountEventPayloadSchema, {
+            piiFields: "none",
+        });
+        r.defineEvent(MAIL_ACCOUNT_DISCONNECTED_EVENT_SHORT, mailAccountEventPayloadSchema, {
+            piiFields: "none",
+        });
+        r.defineEvent(INBOUND_MESSAGE_RECEIVED_EVENT_SHORT, inboundMessageEventPayloadSchema, {
+            piiFields: "none",
+        });
+        r.defineEvent(MAIL_THREAD_UPDATED_EVENT_SHORT, mailThreadEventPayloadSchema, {
+            piiFields: "none",
+        });
+        // Inline projections — apply in derselben TX wie der Append.
+        r.projection({
+            name: "mail-account",
+            source: MAIL_ACCOUNT_AGGREGATE_TYPE,
+            table: mailAccountsProjectionTable,
+            entity: mailAccountEntity,
+            apply: {
+                [MAIL_ACCOUNT_CONNECTED_EVENT_QN]: applyMailAccountConnected,
+                [MAIL_ACCOUNT_UPDATED_EVENT_QN]: applyMailAccountUpdated,
+                [MAIL_ACCOUNT_DISCONNECTED_EVENT_QN]: applyMailAccountDisconnected,
+            },
+        });
+        r.projection({
+            name: "inbound-message",
+            source: INBOUND_MESSAGE_AGGREGATE_TYPE,
+            table: inboundMessagesProjectionTable,
+            entity: inboundMessageEntity,
+            apply: {
+                [INBOUND_MESSAGE_RECEIVED_EVENT_QN]: applyInboundMessageReceived,
+            },
+        });
+        r.projection({
+            name: "mail-thread",
+            source: MAIL_THREAD_AGGREGATE_TYPE,
+            table: mailThreadsProjectionTable,
+            entity: mailThreadEntity,
+            apply: {
+                [MAIL_THREAD_UPDATED_EVENT_QN]: applyMailThreadUpdated,
+            },
+        });
+        // Plugin extension point — providers register via
+        // r.useExtension("inboundMailProvider", "<key>", plugin).
+        r.extendsRegistrar(INBOUND_MAIL_PROVIDER_EXTENSION, {
+            onRegister: () => {
+                // No side-effects at register-time — lookup happens at runtime
+                // via resolveInboundProviderForKey/-Account.
+            },
+        });
+        // Sync machinery: high-frequency tick state, deliberately NOT
+        // event-sourced — r.storeTable keeps the migration DDL but excludes the
+        // tables from the projection rebuild (#494/#498 class).
+        r.storeTable(syncCursorTable, {
+            reason: "read_side.mail_sync_cursors_direct_write",
+        });
+        r.storeTable(seenMessageTable, {
+            reason: "read_side.mail_seen_messages_direct_write",
+        });
+        // Write-Handler:
+        //   - ingest-message: programmatic (Supervisor/Poll, SystemAdmin)
+        //   - connect/update/disconnect-account: Lifecycle
+        r.writeHandler(ingestMessageHandler);
+        r.writeHandler(connectAccountHandler);
+        r.writeHandler(updateAccountHandler);
+        r.writeHandler(disconnectAccountHandler);
+        // List-Queries (PII-decrypted, scope-gefiltert).
+        r.queryHandler(listAccountsQuery);
+        r.queryHandler(listMessagesQuery);
+        // Entity-genaue GDPR-Destroy-Hooks — der gdpr-storage-Boot-Validator
+        // prueft die EXT_TENANT_DATA-Registrierung pro tenant-subject-Entity.
+        r.useExtension(EXT_TENANT_DATA, "mail-account", {
+            destroy: mailAccountTenantDestroyHook,
+            escapeHatch: { reason: INBOUND_MAIL_TENANT_DESTROY_ARCHIVE_REASON },
+        });
+        r.useExtension(EXT_TENANT_DATA, "inbound-message", {
+            destroy: inboundMessageTenantDestroyHook,
+            escapeHatch: { reason: INBOUND_MAIL_TENANT_DESTROY_ARCHIVE_REASON },
+        });
+        r.useExtension(EXT_TENANT_DATA, "mail-thread", {
+            destroy: mailThreadTenantDestroyHook,
+            escapeHatch: { reason: INBOUND_MAIL_TENANT_DESTROY_ARCHIVE_REASON },
+        });
+        // Data-Retention (#957) — perTenant fan-out (one run per tenant, like
+        // data-retention:retention-cleanup): runInboundMailRetention's raw query
+        // helpers need the unfiltered runner, so the handler declares escapeHatch
+        // and reaches for ctx.db.unsafeRaw(). Without this cron, read_inbound_messages
+        // + the bodies grow unbounded (GDPR Art. 5).
+        const INBOUND_MAIL_RETENTION_REASON = "inbound-mail retention runs raw deletes; every statement filters by this run's tenantId";
+        r.job({
+            name: "inbound-mail-retention",
+            trigger: { cron: "0 3 * * *" },
+            perTenant: true,
+            concurrency: "skip",
+            escapeHatch: { reason: INBOUND_MAIL_RETENTION_REASON },
+            handler: async (_payload, ctx) => {
+                if (!ctx.registry) {
+                    throw new Error("inbound-mail-retention: ctx.registry required (JobContext incomplete)");
                 }
-                const provider = await providerPromise;
-                await provider.delete(bodyRef);
-            };
-            const report = await runInboundMailRetention({
-                db: retentionDb,
-                tenantId,
-                now: T.Now.instant(),
-                deleteBodyObject,
-            });
-            if (report.bodyObjectErrors > 0) {
-                // biome-ignore lint/suspicious/noConsole: operator-visibility for failed body deletes
-                console.warn(`[inbound-mail-foundation:inbound-mail-retention] tenant=${tenantId} bodyObjectErrors=${report.bodyObjectErrors}`);
-            }
-        },
-    });
-});
+                const tenantId = ctx.systemUser?.tenantId ?? ctx._tenantId;
+                if (tenantId === undefined) {
+                    // skip: cron fired without a perTenant fan-out tenant — nothing scoped
+                    return;
+                }
+                const T = (await import("@cosmicdrift/kumiko-framework/time")).getTemporal();
+                const retentionDb = ctx.db.unsafeRaw(); // @cast-boundary db-operator — jobs never run inside a DbTx
+                // Body-Objekte liegen in file-foundation. Provider lazy + memoized —
+                // heute schreibt der Ingest kein bodyRef (storeBody-Hook ungebunden),
+                // der Provider wird also nie gebaut. Sobald storeBody wired ist, raeumt
+                // die Retention die Bodies mit ab.
+                let providerPromise = null;
+                const deleteBodyObject = async (bodyRef) => {
+                    if (!providerPromise) {
+                        providerPromise = createFileProviderForTenant({ config: ctx.config, registry: ctx.registry }, tenantId);
+                    }
+                    const provider = await providerPromise;
+                    await provider.delete(bodyRef);
+                };
+                const report = await runInboundMailRetention({
+                    db: retentionDb,
+                    tenantId,
+                    now: T.Now.instant(),
+                    deleteBodyObject,
+                });
+                if (report.bodyObjectErrors > 0) {
+                    // biome-ignore lint/suspicious/noConsole: operator-visibility for failed body deletes
+                    console.warn(`[inbound-mail-foundation:inbound-mail-retention] tenant=${tenantId} bodyObjectErrors=${report.bodyObjectErrors}`);
+                }
+            },
+        });
+    }, { dedupeOptions: {} });
+}
+/** @deprecated Use createInboundMailFoundationFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const inboundMailFoundationFeature = createInboundMailFoundationFeature();

package/dist/inbound-mail-foundation/handlers/ingest-message.write.js

@@ -19,9 +19,8 @@
 //
 // SystemAdmin-only: Aufrufer ist der Watch/Sync-Supervisor bzw. der
 // Poll-Cron mit programmatic SystemUser — nie ein Tenant-Request.
-import { countWhere } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, encryptPiiFieldValues, } from "@cosmicdrift/kumiko-framework/crypto";
-import { acquireNamespacedAdvisoryLock } from "@cosmicdrift/kumiko-framework/db";
+import { acquireNamespacedAdvisoryLock, countWhere } from "@cosmicdrift/kumiko-framework/db";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";

package/dist/inbound-mail-foundation/index.d.ts

@@ -3,7 +3,7 @@ export { createInboundMailConnectRoutes, type InboundMailConnectRoutesOptions, }
 export { INBOUND_MAIL_FOUNDATION_FEATURE, INBOUND_MAIL_PROVIDER_EXTENSION, type InboundMailAccountStatus, InboundMailAccountStatuses, type InboundMailAuthMethod, InboundMailAuthMethods, InboundMailFoundationHandlers, InboundMailFoundationQueries, inboundCredentialSecretKey, } from "./constants.js";
 export { INBOUND_MESSAGE_PII_FIELDS, inboundMessageEntity, MAIL_ACCOUNT_PII_FIELDS, MAIL_THREAD_PII_FIELDS, mailAccountEntity, mailThreadEntity, seenMessageEntity, seenMessageTable, syncCursorEntity, syncCursorTable, } from "./entities.js";
 export { INBOUND_MESSAGE_AGGREGATE_TYPE, INBOUND_MESSAGE_RECEIVED_EVENT_QN, INBOUND_MESSAGE_RECEIVED_EVENT_SHORT, type InboundMessageEventHeaders, type InboundMessageEventPayload, inboundMessageEventPayloadSchema, MAIL_ACCOUNT_AGGREGATE_TYPE, MAIL_ACCOUNT_CONNECTED_EVENT_QN, MAIL_ACCOUNT_CONNECTED_EVENT_SHORT, MAIL_ACCOUNT_DISCONNECTED_EVENT_QN, MAIL_ACCOUNT_DISCONNECTED_EVENT_SHORT, MAIL_ACCOUNT_UPDATED_EVENT_QN, MAIL_ACCOUNT_UPDATED_EVENT_SHORT, MAIL_THREAD_AGGREGATE_TYPE, MAIL_THREAD_UPDATED_EVENT_QN, MAIL_THREAD_UPDATED_EVENT_SHORT, type MailAccountEventHeaders, type MailAccountEventPayload, type MailThreadEventPayload, mailAccountEventPayloadSchema, mailThreadEventPayloadSchema, } from "./events.js";
-export { inboundMailFoundationFeature } from "./feature.js";
+export { createInboundMailFoundationFeature, inboundMailFoundationFeature } from "./feature.js";
 export { createOAuthAccessTokenManager, inboundRefreshTokenSecretOptions, type OAuthAccessTokenManager, type OAuthAccessTokenManagerDeps, usesFoundationManagedOAuth, } from "./oauth-access-token.js";
 export { type OAuthStatePayload, signOAuthState, type VerifyOAuthStateResult, verifyOAuthState, } from "./oauth-state.js";
 export { inboundMessagesProjectionTable, mailAccountsProjectionTable, mailThreadsProjectionTable, } from "./projection.js";

package/dist/inbound-mail-foundation/index.js

@@ -4,7 +4,7 @@ export { createInboundMailConnectRoutes, } from "./connect-routes.js";
 export { INBOUND_MAIL_FOUNDATION_FEATURE, INBOUND_MAIL_PROVIDER_EXTENSION, InboundMailAccountStatuses, InboundMailAuthMethods, InboundMailFoundationHandlers, InboundMailFoundationQueries, inboundCredentialSecretKey, } from "./constants.js";
 export { INBOUND_MESSAGE_PII_FIELDS, inboundMessageEntity, MAIL_ACCOUNT_PII_FIELDS, MAIL_THREAD_PII_FIELDS, mailAccountEntity, mailThreadEntity, seenMessageEntity, seenMessageTable, syncCursorEntity, syncCursorTable, } from "./entities.js";
 export { INBOUND_MESSAGE_AGGREGATE_TYPE, INBOUND_MESSAGE_RECEIVED_EVENT_QN, INBOUND_MESSAGE_RECEIVED_EVENT_SHORT, inboundMessageEventPayloadSchema, MAIL_ACCOUNT_AGGREGATE_TYPE, MAIL_ACCOUNT_CONNECTED_EVENT_QN, MAIL_ACCOUNT_CONNECTED_EVENT_SHORT, MAIL_ACCOUNT_DISCONNECTED_EVENT_QN, MAIL_ACCOUNT_DISCONNECTED_EVENT_SHORT, MAIL_ACCOUNT_UPDATED_EVENT_QN, MAIL_ACCOUNT_UPDATED_EVENT_SHORT, MAIL_THREAD_AGGREGATE_TYPE, MAIL_THREAD_UPDATED_EVENT_QN, MAIL_THREAD_UPDATED_EVENT_SHORT, mailAccountEventPayloadSchema, mailThreadEventPayloadSchema, } from "./events.js";
-export { inboundMailFoundationFeature } from "./feature.js";
+export { createInboundMailFoundationFeature, inboundMailFoundationFeature } from "./feature.js";
 export { createOAuthAccessTokenManager, inboundRefreshTokenSecretOptions, usesFoundationManagedOAuth, } from "./oauth-access-token.js";
 export { signOAuthState, verifyOAuthState, } from "./oauth-state.js";
 export { inboundMessagesProjectionTable, mailAccountsProjectionTable, mailThreadsProjectionTable, } from "./projection.js";

package/dist/inbound-mail-foundation/oauth-access-token.js

@@ -15,8 +15,7 @@
 // The refresh token is re-read inside the lock via `secrets.get` without an
 // audit context. SecretsContext does not cache values (only unwrapped DEKs),
 // so the read always reflects the latest committed write.
-import { transaction } from "@cosmicdrift/kumiko-framework/bun-db";
-import { acquireNamespacedAdvisoryLock } from "@cosmicdrift/kumiko-framework/db";
+import { acquireNamespacedAdvisoryLock, transaction, } from "@cosmicdrift/kumiko-framework/db";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { InboundMailAuthMethods, inboundCredentialSecretKey } from "./constants.js";
 import { InboundAuthError, } from "./types.js";

package/dist/inbound-mail-foundation/projection.js

@@ -16,8 +16,7 @@
 // kommen bereits als Ciphertext an — encrypted VOR dem append im
 // write-handler. Die applies kopieren nur durch; decrypted wird erst
 // in den list-queries.
-import { insertOnConflictDoNothing, requireEntityTableMeta, upsertOnConflict, } from "@cosmicdrift/kumiko-framework/bun-db";
-import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
+import { buildEntityTable, insertOnConflictDoNothing, requireEntityTableMeta, upsertOnConflict, } from "@cosmicdrift/kumiko-framework/db";
 import { defineApply } from "@cosmicdrift/kumiko-framework/engine";
 import { inboundMessageEntity, mailAccountEntity, mailThreadEntity } from "./entities.js";
 // Drizzle-table-instances aus den entity-shapes — geteilt zwischen

package/dist/inbound-mail-foundation/watch-supervisor.js

@@ -43,8 +43,8 @@
 // as the watcher state lives, including across reconnect backoff, not
 // only while the connection is open. Losing the claim (Redis outage, TTL
 // exceeded) tears down the local watcher instead of racing a new holder.
-import { fetchOne, insertOne, selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, decryptPiiFieldValues, } from "@cosmicdrift/kumiko-framework/crypto";
+import { fetchOne, insertOne, selectMany, updateMany } from "@cosmicdrift/kumiko-framework/db";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { InboundMailAccountStatuses, InboundMailFoundationHandlers } from "./constants.js";

package/dist/inbound-provider-imap/feature.d.ts

@@ -4,6 +4,10 @@ export { setImapMailHostLookup } from "./imap-client.js";
 /** Exportiert für den Live-Test (imap-live.integration.test.ts) —
  *  Apps nutzen das Feature, nie das Plugin direkt. */
 export declare const imapInboundMailPlugin: InboundMailProviderPlugin;
+export declare function createInboundProviderImapFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: void;
+};
+/** @deprecated Use createInboundProviderImapFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const inboundProviderImapFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };

package/dist/inbound-provider-imap/feature.js

@@ -217,15 +217,19 @@ export const imapInboundMailPlugin = {
     // Formular (connect-account + Secret-Write); XOAUTH2-Token-Flows
     // gehören den OAuth-Providern (M365/Gmail).
 };
-export const inboundProviderImapFeature = defineFeature(FEATURE_NAME, (r) => {
-    r.describe('Registers the `"imap"` provider for `inbound-mail-foundation` using imapflow — password/app-password auth covers classic IMAP hosts without any OAuth (plus an XOAUTH2 fallback consuming an access token from the secret slot). Incremental sync via a UIDVALIDITY:lastUid cursor (UIDVALIDITY change triggers a cursor-invalid full resync), initial backfill bounded by the foundation backfill window, and live push via IMAP IDLE for the watch supervisor. Store the per-account connection JSON (host/port/secure/user/password) in the account credential secret slot before the first sync.');
-    r.uiHints({
-        displayLabel: "Inbound Mail · IMAP",
-        category: "notifications",
-        recommended: false,
-    });
-    r.requires({ features: ["inbound-mail-foundation"] });
-    r.requires({ features: ["secrets"] });
-    r.envSchema(mailAllowedPrivateHostsEnvSchema);
-    r.useExtension(INBOUND_MAIL_PROVIDER_EXTENSION, IMAP_PROVIDER_KEY, imapInboundMailPlugin);
-});
+export function createInboundProviderImapFeature() {
+    return defineFeature(FEATURE_NAME, (r) => {
+        r.describe('Registers the `"imap"` provider for `inbound-mail-foundation` using imapflow — password/app-password auth covers classic IMAP hosts without any OAuth (plus an XOAUTH2 fallback consuming an access token from the secret slot). Incremental sync via a UIDVALIDITY:lastUid cursor (UIDVALIDITY change triggers a cursor-invalid full resync), initial backfill bounded by the foundation backfill window, and live push via IMAP IDLE for the watch supervisor. Store the per-account connection JSON (host/port/secure/user/password) in the account credential secret slot before the first sync.');
+        r.uiHints({
+            displayLabel: "Inbound Mail · IMAP",
+            category: "notifications",
+            recommended: false,
+        });
+        r.requires({ features: ["inbound-mail-foundation"] });
+        r.requires({ features: ["secrets"] });
+        r.envSchema(mailAllowedPrivateHostsEnvSchema);
+        r.useExtension(INBOUND_MAIL_PROVIDER_EXTENSION, IMAP_PROVIDER_KEY, imapInboundMailPlugin);
+    }, { dedupeOptions: {} });
+}
+/** @deprecated Use createInboundProviderImapFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const inboundProviderImapFeature = createInboundProviderImapFeature();

package/dist/inbound-provider-imap/index.d.ts

@@ -1,3 +1,3 @@
 export { type ImapCredentialDocument, imapCredentialDocumentSchema, type ParseCredentialResult, parseImapCredentialDocument, } from "./credential-document.js";
-export { IMAP_PROVIDER_KEY, inboundProviderImapFeature, setImapMailHostLookup } from "./feature.js";
+export { createInboundProviderImapFeature, IMAP_PROVIDER_KEY, inboundProviderImapFeature, setImapMailHostLookup, } from "./feature.js";
 export { assertUidValidity, buildProviderMessageId, type ImapCursor, mapImapError, normalizeReferences, parseImapCursor, } from "./imap-client.js";

package/dist/inbound-provider-imap/index.js

@@ -1,4 +1,4 @@
 // Public API of the inbound-provider-imap bundled-feature.
 export { imapCredentialDocumentSchema, parseImapCredentialDocument, } from "./credential-document.js";
-export { IMAP_PROVIDER_KEY, inboundProviderImapFeature, setImapMailHostLookup } from "./feature.js";
+export { createInboundProviderImapFeature, IMAP_PROVIDER_KEY, inboundProviderImapFeature, setImapMailHostLookup, } from "./feature.js";
 export { assertUidValidity, buildProviderMessageId, mapImapError, normalizeReferences, parseImapCursor, } from "./imap-client.js";

package/dist/inbound-provider-inmemory/feature.d.ts

@@ -18,6 +18,10 @@ export declare function isWatching(accountId: string): boolean;
  *  nie zwischen Tests teilen). */
 export declare function resetInboundInMemory(): void;
 export declare const inMemoryInboundMailPlugin: InboundMailProviderPlugin;
+export declare function createInboundProviderInMemoryFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: void;
+};
+/** @deprecated Use createInboundProviderInMemoryFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const inboundProviderInMemoryFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };

package/dist/inbound-provider-inmemory/feature.js

@@ -103,13 +103,17 @@ export const inMemoryInboundMailPlugin = {
 // =============================================================================
 // Feature-definition
 // =============================================================================
-export const inboundProviderInMemoryFeature = defineFeature(FEATURE_NAME, (r) => {
-    r.describe('Registers a scriptable in-process `"inmemory"` provider for `inbound-mail-foundation`. Seed messages with `seedInboundMessage(accountId, msg)` — an active watch pushes them immediately (IDLE simulation) and the cursor-based `fetch` re-delivers them on the reconciliation path, exercising the foundation dedup guarantee. Error injection via `failNextFetchWith`/`failNextVerifyWith`/`emitWatchError`; reset state with `resetInboundInMemory()`. For tests, demos and sample apps — not for production.');
-    r.uiHints({
-        displayLabel: "Inbound Mail · In-Memory Provider",
-        category: "notifications",
-        recommended: false,
-    });
-    r.requires({ features: ["inbound-mail-foundation"] });
-    r.useExtension("inboundMailProvider", INMEMORY_PROVIDER_KEY, inMemoryInboundMailPlugin);
-});
+export function createInboundProviderInMemoryFeature() {
+    return defineFeature(FEATURE_NAME, (r) => {
+        r.describe('Registers a scriptable in-process `"inmemory"` provider for `inbound-mail-foundation`. Seed messages with `seedInboundMessage(accountId, msg)` — an active watch pushes them immediately (IDLE simulation) and the cursor-based `fetch` re-delivers them on the reconciliation path, exercising the foundation dedup guarantee. Error injection via `failNextFetchWith`/`failNextVerifyWith`/`emitWatchError`; reset state with `resetInboundInMemory()`. For tests, demos and sample apps — not for production.');
+        r.uiHints({
+            displayLabel: "Inbound Mail · In-Memory Provider",
+            category: "notifications",
+            recommended: false,
+        });
+        r.requires({ features: ["inbound-mail-foundation"] });
+        r.useExtension("inboundMailProvider", INMEMORY_PROVIDER_KEY, inMemoryInboundMailPlugin);
+    }, { dedupeOptions: {} });
+}
+/** @deprecated Use createInboundProviderInMemoryFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const inboundProviderInMemoryFeature = createInboundProviderInMemoryFeature();

package/dist/inbound-provider-inmemory/index.d.ts

@@ -1 +1 @@
-export { emitWatchError, failNextFetchWith, failNextVerifyWith, INMEMORY_PROVIDER_KEY, inboundProviderInMemoryFeature, isWatching, resetInboundInMemory, seedInboundMessage, } from "./feature.js";
+export { createInboundProviderInMemoryFeature, emitWatchError, failNextFetchWith, failNextVerifyWith, INMEMORY_PROVIDER_KEY, inboundProviderInMemoryFeature, isWatching, resetInboundInMemory, seedInboundMessage, } from "./feature.js";

package/dist/inbound-provider-inmemory/index.js

@@ -1,2 +1,2 @@
 // Public API of the inbound-provider-inmemory bundled-feature.
-export { emitWatchError, failNextFetchWith, failNextVerifyWith, INMEMORY_PROVIDER_KEY, inboundProviderInMemoryFeature, isWatching, resetInboundInMemory, seedInboundMessage, } from "./feature.js";
+export { createInboundProviderInMemoryFeature, emitWatchError, failNextFetchWith, failNextVerifyWith, INMEMORY_PROVIDER_KEY, inboundProviderInMemoryFeature, isWatching, resetInboundInMemory, seedInboundMessage, } from "./feature.js";

package/dist/jobs/db/queries/retention.js

@@ -9,7 +9,7 @@
 //
 // deleteManyBatched (typed query API, no raw SQL in this file) chunks each
 // delete so a large backlog doesn't hold one lock for the whole sweep.
-import { deleteManyBatched } from "@cosmicdrift/kumiko-framework/bun-db";
+import { deleteManyBatched } from "@cosmicdrift/kumiko-framework/db";
 import { jobRunLogsTable, jobRunsTable } from "../../job-run-table.js";
 import { tenantJobFailuresTable } from "../../tenant-job-failure-table.js";
 import { tenantJobRunsTable } from "../../tenant-job-run-table.js";

package/dist/jobs/db/queries/stale-run-sweep.js

@@ -11,7 +11,7 @@
 // schema/migration change, no web filter-dropdown/status-enum update, and
 // the run becomes retriable via the existing jobs:write:retry gate
 // (retry.write.ts only allows retry from "failed").
-import { deleteManyBatched, selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { deleteManyBatched, selectMany, updateMany } from "@cosmicdrift/kumiko-framework/db";
 import { mapWithConcurrency } from "../../../shared/index.js";
 import { DEFAULT_JOB_RUN_RETENTION_DAYS } from "../../handlers/retention-cleanup.job.js";
 import { encryptFailureError } from "../../job-run-logger.js";

package/dist/jobs/handlers/detail.query.js

@@ -1,4 +1,4 @@
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/dist/jobs/handlers/list.query.js

@@ -1,5 +1,4 @@
-import { countWhere, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { decodeCursor, encodeCursor } from "@cosmicdrift/kumiko-framework/db";
+import { countWhere, decodeCursor, encodeCursor, selectMany, } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, ValidationError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/dist/jobs/handlers/retry.write.js

@@ -1,5 +1,5 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { isPiiCiphertext, PII_ERASED_SENTINEL } from "@cosmicdrift/kumiko-framework/crypto";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";

package/dist/jobs/handlers/tenant-failures.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { serializeJobSubject } from "@cosmicdrift/kumiko-framework/jobs";

package/dist/jobs/handlers/tenant-runs.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { serializeJobSubject } from "@cosmicdrift/kumiko-framework/jobs";

package/dist/jobs/job-run-logger.js

@@ -1,6 +1,5 @@
-import { deleteMany, fetchOne, insertMany, insertOnConflictDoNothing, insertOne, transaction, updateMany, upsertOnConflict, } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, encryptPiiValueForSubject, KeyErasedError, PII_ERASED_SENTINEL, } from "@cosmicdrift/kumiko-framework/crypto";
-import { acquireNamespacedAdvisoryLock } from "@cosmicdrift/kumiko-framework/db";
+import { acquireNamespacedAdvisoryLock, deleteMany, fetchOne, insertMany, insertOnConflictDoNothing, insertOne, transaction, updateMany, upsertOnConflict, } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";

package/dist/jobs/tenant-job-failure-table.js

@@ -1,5 +1,4 @@
-import { requireEntityTableMeta } from "@cosmicdrift/kumiko-framework/bun-db";
-import { index, instant, table as pgTable, serial, sql, text, uniqueIndex, uuid, } from "@cosmicdrift/kumiko-framework/db";
+import { index, instant, table as pgTable, requireEntityTableMeta, serial, sql, text, uniqueIndex, uuid, } from "@cosmicdrift/kumiko-framework/db";
 // The tenant's own view of a failed job (fw#3079). Direct-write store like
 // store_job_runs: job-run-logger.ts writes it from the BullMQ callbacks,
 // outside any dispatcher transaction.

package/dist/jobs/tenant-job-run-table.js

@@ -1,5 +1,4 @@
-import { requireEntityTableMeta } from "@cosmicdrift/kumiko-framework/bun-db";
-import { index, instant, table as pgTable, serial, sql, text, uniqueIndex, uuid, } from "@cosmicdrift/kumiko-framework/db";
+import { index, instant, table as pgTable, requireEntityTableMeta, serial, sql, text, uniqueIndex, uuid, } from "@cosmicdrift/kumiko-framework/db";
 // The tenant's own view of a job's run state (fw#3616). Direct-write store
 // like store_job_runs, written by job-run-logger.ts from the runner callbacks.
 //