@cosmicdrift/kumiko-bundled-features 0.367.0 → 0.368.0

package/dist/notes-history-user-data/index.d.ts

@@ -1,4 +1,8 @@
 export { eraseNoteBodiesReachingSubject } from "./hooks.js";
+export declare function createNotesHistoryUserDataFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: void;
+};
+/** @deprecated Use createNotesHistoryUserDataFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const notesHistoryUserDataFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };

package/dist/notes-history-user-data/index.js

@@ -7,20 +7,24 @@
 import { defineFeature, EXT_USER_DATA } from "@cosmicdrift/kumiko-framework/engine";
 import { noteEntryDeleteHook, noteEntryExportHook, noteMentionDeleteHook, noteMentionExportHook, } from "./hooks.js";
 export { eraseNoteBodiesReachingSubject } from "./hooks.js";
-export const notesHistoryUserDataFeature = defineFeature("notes-history-user-data", (r) => {
-    r.describe("GDPR (Art. 20 export / Art. 17 erasure) coverage for the `notes-history` feature's `note-entry` and `note-mention` entities. Mounts the export hook so a user's authored notes are included in the user-data export bundle; the note-entry delete hook crypto-shreds the row-subject key of each note that structurally @-mentions the forgotten user (`note-mention`) or hangs on the user as host entity (regardless of the host entity's retention strategy: the note text is free PII, the host's anonymize/blockDelete protects the row, not the content), keeping the append-only history intact for all other notes. The manual `crypto-shredding` forget-subject command reaches the same notes for user and record subjects through the exported `eraseNoteBodiesReachingSubject`, and the export lists them under `note-mention`. `note-mention`'s own hooks are a no-op — it is a plain FK pointer, not separately exportable content. Kept separate from `notes-history` so notes consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `notes-history`.");
-    // user-data-rights is the hard dependency (EXT_USER_DATA host). notes-history
-    // is OPTIONAL: if it's mounted toggleable(default=false), a hard r.requires
-    // would throw an "effectively disabled" boot warning even though the
-    // note-entry entity exists and the hooks work fine.
-    r.requires({ features: ["user-data-rights"] });
-    r.optionalRequires("notes-history");
-    r.useExtension(EXT_USER_DATA, "note-entry", {
-        export: noteEntryExportHook,
-        delete: noteEntryDeleteHook,
-    });
-    r.useExtension(EXT_USER_DATA, "note-mention", {
-        export: noteMentionExportHook,
-        delete: noteMentionDeleteHook,
-    });
-});
+export function createNotesHistoryUserDataFeature() {
+    return defineFeature("notes-history-user-data", (r) => {
+        r.describe("GDPR (Art. 20 export / Art. 17 erasure) coverage for the `notes-history` feature's `note-entry` and `note-mention` entities. Mounts the export hook so a user's authored notes are included in the user-data export bundle; the note-entry delete hook crypto-shreds the row-subject key of each note that structurally @-mentions the forgotten user (`note-mention`) or hangs on the user as host entity (regardless of the host entity's retention strategy: the note text is free PII, the host's anonymize/blockDelete protects the row, not the content), keeping the append-only history intact for all other notes. The manual `crypto-shredding` forget-subject command reaches the same notes for user and record subjects through the exported `eraseNoteBodiesReachingSubject`, and the export lists them under `note-mention`. `note-mention`'s own hooks are a no-op — it is a plain FK pointer, not separately exportable content. Kept separate from `notes-history` so notes consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `notes-history`.");
+        // user-data-rights is the hard dependency (EXT_USER_DATA host). notes-history
+        // is OPTIONAL: if it's mounted toggleable(default=false), a hard r.requires
+        // would throw an "effectively disabled" boot warning even though the
+        // note-entry entity exists and the hooks work fine.
+        r.requires({ features: ["user-data-rights"] });
+        r.optionalRequires("notes-history");
+        r.useExtension(EXT_USER_DATA, "note-entry", {
+            export: noteEntryExportHook,
+            delete: noteEntryDeleteHook,
+        });
+        r.useExtension(EXT_USER_DATA, "note-mention", {
+            export: noteMentionExportHook,
+            delete: noteMentionDeleteHook,
+        });
+    }, { dedupeOptions: {} });
+}
+/** @deprecated Use createNotesHistoryUserDataFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const notesHistoryUserDataFeature = createNotesHistoryUserDataFeature();

package/dist/personal-access-tokens/feature.d.ts

@@ -1,4 +1,4 @@
-import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type FeatureDefinition, type ProjectionListScreenDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { type PatRateLimit } from "./constants.js";
 import { type CreatePatOptions } from "./handlers/create.write.js";
 import type { PatScopeConfig } from "./scopes.js";
@@ -17,6 +17,9 @@ export type PersonalAccessTokensOptions = {
      *  shown in place of the token screens when the tenant's tier excludes the
      *  feature, e.g. an upgrade notice. Default: the standard "unavailable" notice. */
     readonly lockedFallbackScreen?: string;
+    /** Description (i18n key) and slots rendered on the token list screen, e.g. an
+     *  explanatory text or a header component above the list. Default: neither. */
+    readonly listScreen?: Pick<ProjectionListScreenDefinition, "description" | "slots">;
     readonly mfaVerifier?: CreatePatOptions["mfaVerifier"];
     readonly autoRevokeOnPasswordChange?: (userId: string) => Promise<number>;
 };

package/dist/personal-access-tokens/feature.js

@@ -1,7 +1,7 @@
 import { EXT_TOKEN_VERIFIER, } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { PAT_TOKEN_PREFIX } from "@cosmicdrift/kumiko-framework/api";
 import { deriveEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
-import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { defineFeature, } from "@cosmicdrift/kumiko-framework/engine";
 import { API_TOKEN_ENTITY_NAME, PAT_DEFAULT_RATE_LIMIT, PAT_FEATURE, } from "./constants.js";
 import { availabilityQuery } from "./handlers/availability.query.js";
 import { buildAvailableScopesQuery } from "./handlers/available-scopes.query.js";
@@ -116,7 +116,15 @@ export function createPersonalAccessTokensFeature(options) {
         // Declarative screens — list-with-revoke + mint-with-reveal. The app
         // places `patListScreen` via r.nav in its logged-in settings area.
         const lockedFallback = options.lockedFallbackScreen === undefined ? {} : { fallback: options.lockedFallbackScreen };
-        r.screen({ ...patListScreen, ...lockedFallback });
+        // Copy the two fields explicitly: a wider object passed as a variable
+        // escapes the Pick check and would override agent/access otherwise.
+        const { description, slots } = options.listScreen ?? {};
+        r.screen({
+            ...patListScreen,
+            ...(description === undefined ? {} : { description }),
+            ...(slots === undefined ? {} : { slots }),
+            ...lockedFallback,
+        });
         r.screen({ ...createPatMintScreen(scopes), ...lockedFallback });
         r.translations({ keys: { ...PAT_FEATURE_I18N, ...patScopeOptionTranslations(scopes) } });
         // rateLimit flows into feature.exports so run-prod-app builds the

package/dist/personal-access-tokens/handlers/create.write.js

@@ -1,4 +1,4 @@
-import { insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { insertOne } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";

package/dist/personal-access-tokens/handlers/list.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { definePagedQueryHandler, MAX_LIST_LIMIT } from "@cosmicdrift/kumiko-framework/engine";
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
@@ -7,7 +7,7 @@ import { isExpiredAt } from "../expiry.js";
 import { apiTokenTable } from "../schema/api-token.js";
 // `sort` arrives raw from the client's query string. selectMany's orderBy has
 // no column-existence check — an unrecognised field just gets snake_cased and
-// quoted as-is (bun-db/query.ts columnOf) — so this allowlist is what stops a
+// quoted as-is (db/query.ts columnOf) — so this allowlist is what stops a
 // client sorting by tokenHash or any other non-exposed column.
 const SORTABLE_COLUMNS = ["id", "name", "createdAt", "expiresAt", "revokedAt"];
 function isSortableColumn(value) {

package/dist/personal-access-tokens/handlers/revoke.write.js

@@ -1,4 +1,4 @@
-import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { updateMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";

package/dist/personal-access-tokens/resolver.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { isExpiredAt } from "./expiry.js";
 import { hashPatToken } from "./hash.js";
 import { resolvePatRoles } from "./roles.js";

package/dist/personal-access-tokens/revoke-for-user.js

@@ -1,4 +1,4 @@
-import { runnerCanBeginTransaction, transaction, updateMany, } from "@cosmicdrift/kumiko-framework/bun-db";
+import { runnerCanBeginTransaction, transaction, updateMany, } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { append } from "@cosmicdrift/kumiko-framework/event-store";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";

package/dist/personal-access-tokens/roles.js

@@ -1,10 +1,8 @@
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { buildSessionRoles } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
-// kumiko-lint-ignore cross-feature-import shared lifecycle-status gate with session auth
-import { isPrincipalBlocked } from "../sessions/index.js";
 import { tenantMembershipsTable } from "../tenant/index.js";
-import { userTable } from "../user/index.js";
+import { isPrincipalRowBlocked, userTable } from "../user/index.js";
 // Live role resolution for a (userId, tenantId), mirroring login.write.ts:
 // global roles (users.roles) ∪ tenant-membership roles (forbidden roles
 // stripped via stripForbiddenMembershipRoles, see engine/membership-roles).
@@ -26,7 +24,7 @@ export async function resolvePatRoles(db, userId, tenantId) {
     const userRow = await fetchOne(db, userTable, {
         id: userId,
     });
-    if (userRow && isPrincipalBlocked(userRow.status))
+    if (userRow && isPrincipalRowBlocked(userRow))
         return null;
     const globalRoles = parseRoles(userRow?.roles ?? null);
     return buildSessionRoles(globalRoles, parseRoles(membership.roles));

package/dist/personal-access-tokens/screens.js

@@ -16,6 +16,7 @@ const PAT_SCREEN_VISIBLE_WHEN = {
 export const patListScreen = {
     id: PAT_SCREEN_ID,
     type: "projectionList",
+    agent: { expose: false },
     visibleWhen: PAT_SCREEN_VISIBLE_WHEN,
     query: PatQueries.mine,
     // The `mine` handler honours `limit` only (no offset/total), so a pager would
@@ -97,6 +98,7 @@ export function createPatMintScreen(scopes) {
     return {
         id: PAT_MINT_SCREEN_ID,
         type: "secretMint",
+        agent: { expose: false },
         visibleWhen: PAT_SCREEN_VISIBLE_WHEN,
         handler: PatHandlers.create,
         fields: {

package/dist/readiness/feature.d.ts

@@ -1,3 +1,11 @@
+export declare function createReadinessFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: {
+        queries: {
+            status: import("@cosmicdrift/kumiko-types/handlers").HandlerRef;
+        };
+    };
+};
+/** @deprecated Use createReadinessFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const readinessFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: {
         queries: {

package/dist/readiness/feature.js

@@ -9,17 +9,21 @@
 // `ready` boolean — the settings-checklist call for admin UIs.
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { statusQuery } from "./handlers/status.query.js";
-export const readinessFeature = defineFeature("readiness", (r) => {
-    r.describe("One-call tenant-onboarding probe: `readiness:query:status` rolls up every config key and secret declared `required: true` across all mounted features and reports which still lack a usable value for the calling tenant, plus a single `ready` boolean. Provider-features under an `r.extensionSelector`-declared extension point count only while their provider is the selected one — a tenant on the inmemory mail transport is not blocked by unset SMTP keys. Mount it (together with `config` and `secrets`) when an admin UI needs a settings checklist before the first mail-send or file-write; the per-concern lists stay available via `config:query:readiness` and `secrets:query:list`.");
-    r.uiHints({
-        displayLabel: "Readiness · Onboarding Probe",
-        category: "operations",
-        recommended: false,
-    });
-    r.requires({ features: ["config"] });
-    r.requires({ features: ["secrets"] });
-    const queries = {
-        status: r.queryHandler(statusQuery),
-    };
-    return { queries };
-});
+export function createReadinessFeature() {
+    return defineFeature("readiness", (r) => {
+        r.describe("One-call tenant-onboarding probe: `readiness:query:status` rolls up every config key and secret declared `required: true` across all mounted features and reports which still lack a usable value for the calling tenant, plus a single `ready` boolean. Provider-features under an `r.extensionSelector`-declared extension point count only while their provider is the selected one — a tenant on the inmemory mail transport is not blocked by unset SMTP keys. Mount it (together with `config` and `secrets`) when an admin UI needs a settings checklist before the first mail-send or file-write; the per-concern lists stay available via `config:query:readiness` and `secrets:query:list`.");
+        r.uiHints({
+            displayLabel: "Readiness · Onboarding Probe",
+            category: "operations",
+            recommended: false,
+        });
+        r.requires({ features: ["config"] });
+        r.requires({ features: ["secrets"] });
+        const queries = {
+            status: r.queryHandler(statusQuery),
+        };
+        return { queries };
+    }, { dedupeOptions: {} });
+}
+/** @deprecated Use createReadinessFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const readinessFeature = createReadinessFeature();

package/dist/readiness/index.d.ts

@@ -1,3 +1,3 @@
 export { READINESS_FEATURE, ReadinessQueries } from "./constants.js";
-export { readinessFeature } from "./feature.js";
+export { createReadinessFeature, readinessFeature } from "./feature.js";
 export type { ReadinessMissingSecret } from "./handlers/status.query.js";

package/dist/readiness/index.js

@@ -1,2 +1,2 @@
 export { READINESS_FEATURE, ReadinessQueries } from "./constants.js";
-export { readinessFeature } from "./feature.js";
+export { createReadinessFeature, readinessFeature } from "./feature.js";

package/dist/secrets/db/queries/read.js

@@ -1,4 +1,4 @@
-import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/db";
 export async function selectTenantSecretEnvelope(db, tenantId, key) {
     const rows = await asRawClient(db).unsafe(`SELECT envelope FROM read_tenant_secrets WHERE tenant_id = $1 AND key = $2 LIMIT 1`, [tenantId, key]);
     return rows[0]?.envelope;

package/dist/secrets/feature.d.ts

@@ -25,6 +25,9 @@ export { type StoredEnvelope, type StoredMetadata, tenantSecretsTable } from "./
 export declare function requireSecretsContext(ctx: {
     readonly secrets?: SecretsContext;
     readonly _userId?: string | undefined;
+    readonly user?: {
+        readonly id: string;
+    };
 }, handlerName: string): SecretsContext;
 export type SecretsFeatureOptions = {
     /** Access rule for the `set`, `delete` and `list` handlers. Default

package/dist/secrets/feature.js

@@ -53,6 +53,7 @@ export { tenantSecretsTable } from "./table.js";
 // FileProviderContext-Pfade (S3-Plugin im Worker) liefern dieselben
 // zwei Felder, also reicht die schmale ctx-shape — kein voller
 // HandlerContext-Import noetig.
+// Handler contexts carry the caller as ctx.user, provider contexts set _userId (takes precedence).
 export function requireSecretsContext(ctx, handlerName) {
     if (!ctx.secrets) {
         throw new InternalError({
@@ -60,10 +61,10 @@ export function requireSecretsContext(ctx, handlerName) {
                 "createSecretsContext({db, masterKeyProvider, registry}) via extraContext.secrets at boot.",
         });
     }
-    const userId = ctx._userId;
+    const userId = ctx._userId ?? ctx.user?.id;
     if (!userId) {
         throw new InternalError({
-            message: `[${handlerName}] ctx._userId missing — cannot audit secret reads without a caller identity.`,
+            message: `[${handlerName}] ctx._userId missing (and no ctx.user) — cannot audit secret reads without a caller identity.`,
         });
     }
     const withAudit = (raw) => ({

package/dist/secrets/handlers/rotate.job.js

@@ -16,8 +16,7 @@
 // check to the executor's stream-version check; a parallel secrets.set
 // that landed the row on the new kekVersion first surfaces here as a
 // version_conflict error (counted as "skipped", not "failed").
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb, selectMany, } from "@cosmicdrift/kumiko-framework/db";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { decodeStoredEnvelope, encodeStoredEnvelope, rewrapDek, } from "@cosmicdrift/kumiko-framework/secrets";
 import { runChunkedMigration } from "../../shared/index.js";
@@ -48,7 +47,7 @@ export async function rotateJob(rawPayload, ctx, db) {
     function tdbFor(tenantId) {
         let existing = tdbCache.get(tenantId);
         if (!existing) {
-            existing = createTenantDb(db, tenantId, "system");
+            existing = createTenantDb({ db, tenantId, mode: "system" });
             tdbCache.set(tenantId, existing);
         }
         return existing;

package/dist/secrets/secrets-context.js

@@ -11,8 +11,7 @@
 //           race on the secret's own version). The audit invariant ("every
 //           read logged") now sits on the events-table instead of a
 //           dedicated audit-table.
-import { fetchOne, transaction } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb, fetchOne, transaction, } from "@cosmicdrift/kumiko-framework/db";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { append } from "@cosmicdrift/kumiko-framework/event-store";
 import { createDekCache, createSecret, decodeStoredEnvelope, decryptValue, encodeStoredEnvelope, encryptValue, withDekCache, } from "@cosmicdrift/kumiko-framework/secrets";
@@ -140,7 +139,7 @@ function buildSecretsContext(opts, provider, db, runnerIsTransaction) {
                 tenantId,
                 roles: SYSTEM_ROLES,
             };
-            const tdb = createTenantDb(db, tenantId, "system");
+            const tdb = createTenantDb({ db, tenantId, mode: "system" });
             const existing = await lookup(tenantId, key);
             const commonFields = {
                 envelope: stored,
@@ -194,7 +193,7 @@ function buildSecretsContext(opts, provider, db, runnerIsTransaction) {
                 tenantId,
                 roles: SYSTEM_ROLES,
             };
-            const tdb = createTenantDb(db, tenantId, "system");
+            const tdb = createTenantDb({ db, tenantId, mode: "system" });
             const result = await executor.delete({ id: existing.id }, actor, tdb);
             return result.isSuccess;
         },

package/dist/sessions/db/queries/cleanup.js

@@ -1,4 +1,4 @@
-import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/db";
 export async function deleteStaleSessionsBatch(db, olderThanDays, batchSize) {
     const rows = await asRawClient(db).unsafe(`DELETE FROM "store_user_sessions"
      WHERE "id" IN (

package/dist/sessions/handlers/detail.query.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared/index.js";

package/dist/sessions/handlers/list.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, definePagedQueryHandler, MAX_LIST_LIMIT, } from "@cosmicdrift/kumiko-framework/engine";
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
@@ -6,7 +6,7 @@ import { decryptStoredPii } from "../../shared/index.js";
 import { userSessionTable } from "../schema/user-session.js";
 // `sort` arrives raw from the client's query string. selectMany's orderBy
 // has no column-existence check — an unrecognised field just gets
-// snake_cased and quoted as-is (bun-db/query.ts columnOf) — so this
+// snake_cased and quoted as-is (db/query.ts columnOf) — so this
 // allowlist is what stops a client sorting by ip/userAgent or any other
 // non-exposed column.
 const SORTABLE_COLUMNS = ["id", "userId", "createdAt", "expiresAt", "revokedAt"];

package/dist/sessions/handlers/mine.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { definePagedQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared/index.js";

package/dist/sessions/handlers/revoke-all-for-user.write.js

@@ -1,5 +1,5 @@
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
-import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { updateMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineWriteHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { append } from "@cosmicdrift/kumiko-framework/event-store";

package/dist/sessions/handlers/revoke-all-others.write.js

@@ -1,4 +1,4 @@
-import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { updateMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";

package/dist/sessions/handlers/revoke.write.js

@@ -1,4 +1,4 @@
-import { fetchOne, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, updateMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";

package/dist/sessions/session-callbacks.js

@@ -1,11 +1,11 @@
-import { fetchOne, insertOne, transaction, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, insertOne, transaction, updateMany } from "@cosmicdrift/kumiko-framework/db";
 import { buildSessionRoles, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { append } from "@cosmicdrift/kumiko-framework/event-store";
 import { generateId, parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { encryptForDirectWrite } from "../shared/index.js";
 import { tenantMembershipsTable } from "../tenant/index.js";
-import { isPrincipalBlocked, userTable } from "../user/index.js";
+import { isPrincipalBlocked, isPrincipalRowBlocked, userTable, } from "../user/index.js";
 import { DEFAULT_SESSION_EXPIRY_MS, LAST_SEEN_REFRESH_MS, USER_SESSION_ENTITY_NAME, } from "./constants.js";
 import { userSessionEntity, userSessionTable } from "./schema/user-session.js";
 import { SESSION_REVOKED_AGGREGATE_TYPE, SESSION_REVOKED_EVENT_QN, sessionRevokedSchema, } from "./session-revoked-event.js";
@@ -112,16 +112,14 @@ export function createSessionCallbacks(opts) {
             // falls back to the JWT's frozen roles claim.
             let user;
             try {
-                user = await fetchOne(db, userTable, {
-                    id: expectedUserId,
-                });
+                user = await fetchOne(db, userTable, { id: expectedUserId });
             }
             catch {
                 return "live";
             }
             if (!user)
                 return "live";
-            if (isPrincipalBlocked(user.status))
+            if (isPrincipalRowBlocked(user))
                 return "blocked";
             // Same fail-open reasoning as the userTable lookup above — a transient
             // DB error on the membership read must not lock the user out. A

package/dist/sessions/testing.d.ts

@@ -1,6 +1,6 @@
 import type { AuthRoutesConfig, SessionCreator } from "@cosmicdrift/kumiko-framework/api";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
-import type { LateBoundHolder } from "@cosmicdrift/kumiko-framework/testing";
+import type { LateBoundHolder } from "@cosmicdrift/kumiko-testing/helpers";
 import type { SessionCallbacks, SessionMassRevoker } from "./session-callbacks.js";
 export type BoundSessionCallbacks = {
     /** auth-config fragment: creator + revoker + checker, all late-bound. */

package/dist/tags/feature.d.ts

@@ -2,7 +2,7 @@ import { type AccessRule, type EntityDefinition } from "@cosmicdrift/kumiko-fram
 type TagsToggleable = {
     readonly default: boolean;
 };
-export declare const tagsFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+declare const defaultTagsFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };
 export type TagsFeatureOptions = {
@@ -44,5 +44,9 @@ export type TagsFeatureOptions = {
      *  otherwise considers every registered entity as a candidate host. */
     readonly parents?: readonly string[];
 };
-export declare function createTagsFeature(opts?: TagsFeatureOptions): typeof tagsFeature;
+export declare function createTagsFeature(opts?: TagsFeatureOptions): typeof defaultTagsFeature;
+/** @deprecated Use createTagsFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export declare const tagsFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: void;
+};
 export {};

package/dist/tags/feature.js

@@ -84,7 +84,7 @@ function registerTags(r, access, toggleable, ownership, parents) {
     r.screen(createTagEditScreen(access));
     r.translations({ keys: TAGS_FEATURE_I18N });
 }
-export const tagsFeature = defineFeature(TAGS_FEATURE_NAME, (r) => registerTags(r, DEFAULT_TAG_ACCESS, undefined, undefined, undefined));
+const defaultTagsFeature = defineFeature(TAGS_FEATURE_NAME, (r) => registerTags(r, DEFAULT_TAG_ACCESS, undefined, undefined, undefined));
 function resolveAccess(opts) {
     if (opts.access !== undefined)
         return opts.access;
@@ -101,7 +101,7 @@ export function createTagsFeature(opts = {}) {
         opts.toggleable === undefined &&
         opts.ownership === undefined &&
         opts.parents === undefined) {
-        return tagsFeature;
+        return defaultTagsFeature;
     }
     if (opts.parents !== undefined && opts.parents.length === 0) {
         throw new Error("createTagsFeature({ parents }): parents must not be an empty array — " +
@@ -113,3 +113,5 @@ export function createTagsFeature(opts = {}) {
     const access = resolveAccess(opts);
     return defineFeature(TAGS_FEATURE_NAME, (r) => registerTags(r, access, opts.toggleable, opts.ownership, opts.parents));
 }
+/** @deprecated Use createTagsFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const tagsFeature = createTagsFeature();

package/dist/template-resolver/api.js

@@ -1,7 +1,7 @@
 // TemplateResolverApi — cross-feature interface. renderer-foundation,
 // delivery and apps import types ONLY and take the implementation from
 // ctx.templateResolver at runtime.
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { FALLBACK_LOCALE, SYSTEM_TENANT_ID } from "./constants.js";
 import { fileAttachmentsOf, imageLinksOf, parseLinkedResourceEntries, pdfAttachmentLinksOf, } from "./linked-resources.js";

package/dist/template-resolver/handlers/bundle-import.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { ValidationError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { requireForTenant } from "../../shared/index.js";
 import { attachmentLimitFailure, attachmentNeedsMailTemplate, createPreparedBundleResourceEntry, prepareTemplateAttachmentBeforeTransaction, prepareTemplateResourceBeforeTransaction, readTemplateResourceMaxBytes, releaseAll, } from "../store-template-resource.js";

package/dist/template-resolver/handlers/by-slug.query.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { TEXT_BLOCK_KIND } from "../constants.js";

package/dist/template-resolver/handlers/by-tenant.query.js

@@ -1,5 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { castTenantRows } from "@cosmicdrift/kumiko-framework/db";
+import { castTenantRows, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { TEXT_BLOCK_KIND } from "../constants.js";

package/dist/template-resolver/handlers/collection-item.query.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { collectionStore, DEFAULT_COLLECTION_ACCESS, toCollectionEntry, } from "./collection-shared.js";

package/dist/template-resolver/handlers/collection-list.query.js

@@ -1,5 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { castTenantRows } from "@cosmicdrift/kumiko-framework/db";
+import { castTenantRows, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { collectionStore, DEFAULT_COLLECTION_ACCESS, toCollectionEntry, } from "./collection-shared.js";

package/dist/template-resolver/handlers/collection-set.write.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { ValidationError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/dist/template-resolver/handlers/copy-locale.write.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, NotFoundError, ValidationError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";

package/dist/template-resolver/handlers/diff-to-system.query.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/dist/template-resolver/handlers/export-bundle.query.js

@@ -1,5 +1,5 @@
 import { isDeepStrictEqual } from "node:util";
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, ValidationError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/dist/template-resolver/handlers/find-by-id.query.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { templateResourcesTable } from "../table.js";

package/dist/template-resolver/handlers/layout-source.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { FALLBACK_LOCALE } from "../constants.js";

package/dist/template-resolver/handlers/list.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { TEMPLATE_KINDS, TEMPLATE_STATUSES } from "../constants.js";

package/dist/template-resolver/handlers/overview.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { DEFAULT_MAIL_LAYOUT_SLUG, FALLBACK_LOCALE } from "../constants.js";

package/dist/template-resolver/handlers/reset-to-system.write.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, ValidationError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";