@cosmicdrift/kumiko-bundled-features 0.367.0 → 0.369.0

package/dist/tier-engine/feature.js

@@ -40,8 +40,7 @@
 //
 // **Boot-Dependencies:** config + tenant.
 // kumiko-lint-ignore app-feature-structure Phase-3 conversion tracked in #2312 (feature.ts > 300 lines)
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { buildEntityTable, createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-framework/db";
+import { buildEntityTable, createEventStoreExecutor, createTenantDb, fetchOne, selectMany, } from "@cosmicdrift/kumiko-framework/db";
 import { defineEntityCreateHandler, defineEntityListHandler, defineEntityUpdateHandler, defineFeature, defineQueryHandler, HookPhases, SYSTEM_TENANT_ID, TENANT_TIER_RESOLVER_EXT, } from "@cosmicdrift/kumiko-framework/engine";
 import { getUnscopedAggregateStreamMaxVersion } from "@cosmicdrift/kumiko-framework/event-store";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
@@ -217,14 +216,14 @@ export function createTierEngineFeature(opts = {}) {
         if (!opts.tierMap)
             return;
         const tierMap = opts.tierMap;
-        // Closure-state: cache per-tenant effective Sets. Hooks halten den
-        // cache aktuell during process-lifetime; build() im extension-pickup
-        // pre-loaded existing assignments at boot.
+        // Closure state: per-tenant cache of effective sets. Hooks keep the
+        // cache current during the process lifetime; build() in the extension
+        // pickup pre-loads existing assignments at boot.
         const cache = new Map();
-        // alwaysOn-Set wird in build(deps) aus registry.features berechnet (alle
-        // non-toggleable features). Hooks brauchen Zugriff darauf für
-        // mergeAlwaysOn-calls — Late-bind via mutable holder, gefüllt vor allen
-        // Requests (build läuft pre-listen via runDevApp/runProdApp-pickup).
+        // The alwaysOn set is computed in build(deps) from registry.features (all
+        // non-toggleable features). Hooks need it for mergeAlwaysOn calls — late
+        // bound via a mutable holder, filled before any request (build runs
+        // pre-listen via the runDevApp/runProdApp pickup).
         const alwaysOnHolder = { set: new Set() };
         // Bus handed to build(); hooks fire outside build and publish through it.
         const busHolder = { bus: undefined };
@@ -242,13 +241,14 @@ export function createTierEngineFeature(opts = {}) {
             // The writer already updated its own cache; only other pods need to re-read.
             busHolder.bus?.publish(CACHE_SYNC_TOPICS.tierAssignment, message, { remoteOnly: true });
         };
-        // Trial: zeit-abgeleitet aus tenant.inserted_at (≈ Signup), live am
-        // Feature-Gate geprüft — NICHT im Resolver-Cache. Der Resolver ist
-        // boot-cached + synchron und sieht weder frische Signups noch den
-        // Zeitablauf; der Trial-Status ändert sich aber mit der Zeit und gilt ab
-        // Sekunde 1 nach Signup. Darum lebt er als async trialGate (unten, am
-        // build-Ende angehängt), den der dispatcher nur auf dem disabled-Pfad
-        // konsultiert. trialFeatures = fixe Feature-Menge des Trial-Tiers.
+        // Trial: derived from time (tenant.inserted_at ≈ signup) and checked live
+        // at the feature gate — NOT in the resolver cache. The resolver is
+        // boot-cached and synchronous, so it sees neither fresh signups nor the
+        // passage of time; the trial status changes over time and applies from
+        // second 1 after signup. That is why it lives as an async trialGate
+        // (below, attached at the end of build) which the dispatcher consults
+        // only on the disabled path. trialFeatures = fixed feature set of the
+        // trial tier.
         if (opts.trial && !tierMap[opts.trial.tier]) {
             throw new Error(`tier-engine: trial.tier "${opts.trial.tier}" is not a key in tierMap — trial would unlock no features`);
         }
@@ -286,7 +286,7 @@ export function createTierEngineFeature(opts = {}) {
             target: { allOf: "tier-assignment" },
             handler: async (payload) => {
                 const data = payload.data; // @cast-boundary engine-payload
-                // skip: gleiche type-guard semantik wie postSave-hook oben.
+                // skip: same type-guard semantics as the postSave hook above.
                 if (typeof data.tenantId !== "string")
                     return;
                 const tenantId = data.tenantId;
@@ -295,18 +295,19 @@ export function createTierEngineFeature(opts = {}) {
                 publishAssignmentChange(tenantId);
             },
         });
-        // Auto-default-tier-on-tenant-signup: hook fires inTransaction (atomic
-        // mit tenant-create rollback), schreibt tier-assignment via Direct-
-        // Executor (nicht ctx.write — hook hat AppContext). Pattern analog
-        // tenant/seeding.ts seedTenant.
+        // Auto-default-tier-on-tenant-signup: the hook fires inTransaction (atomic
+        // with the tenant-create rollback) and writes the tier-assignment via the
+        // direct executor (not ctx.write — the hook has an AppContext). Same
+        // pattern as seedTenant in tenant/seeding.ts.
         //
-        // **Idempotency:** deterministic aggregate-id aus tenantId. Re-replay
-        // (nach projection-rebuild oder hook-retry) findet stream-version > 0
-        // und skipt, statt version_conflict zu werfen. Caller sieht erfolgreichen
-        // tenant-create + bestehende tier-assignment.
+        // **Idempotency:** deterministic aggregate id derived from tenantId. A
+        // re-replay (after a projection rebuild or hook retry) finds
+        // stream-version > 0 and skips instead of throwing version_conflict. The
+        // caller sees a successful tenant-create plus the existing
+        // tier-assignment.
         //
-        // **Cross-tenant write:** executor braucht systemUser MIT tenantId =
-        // neuer Tenant (Memory `feedback_event_store_tenant_consistency`).
+        // **Cross-tenant write:** the executor needs a systemUser WITH tenantId =
+        // the new tenant (memory `feedback_event_store_tenant_consistency`).
         if (opts.defaultTier !== undefined) {
             const defaultTier = opts.defaultTier;
             const autoDefaultTierHookReason = "seeds the default tier-assignment stream of the tenant just created";
@@ -314,16 +315,16 @@ export function createTierEngineFeature(opts = {}) {
                 type: "postSave",
                 target: { allOf: "tenant" },
                 handler: async (result, ctx) => {
-                    // result-shape: kumiko-framework's SaveContext mit isNew + data
+                    // result shape: kumiko-framework's SaveContext with isNew + data
                     const saveResult = result; // @cast-boundary engine-payload
-                    // skip: nur bei tenant-create (initial) — tenant-updates feuern
-                    // auch postSave aber wir wollen kein neues tier-assignment bei
-                    // re-keying oder name-update.
+                    // skip: only on tenant-create (initial) — tenant updates fire
+                    // postSave too, but a re-keying or name update must not create a
+                    // new tier-assignment.
                     if (saveResult.isNew !== true)
                         return;
                     const data = saveResult.data; // @cast-boundary engine-payload
-                    // skip: defensive type-guard. Tenant-entity hat id zwingend, aber
-                    // CrudExecutor's payload-shape ist runtime-unknown.
+                    // skip: defensive type guard. The tenant entity always has an id, but
+                    // CrudExecutor's payload shape is unknown at runtime.
                     if (typeof data.id !== "string")
                         return;
                     const newTenantId = data.id; // @cast-boundary engine-payload
@@ -342,48 +343,47 @@ export function createTierEngineFeature(opts = {}) {
                     // blocking), silent-skip is defensive-soft.
                     if (!rawDb)
                         return;
-                    // Idempotency: stream-existence-check vor create. Pattern aus
-                    // seedTenant.ts. Bei re-replay (rebuild) nicht versionsbumpen.
+                    // Idempotency: stream-existence check before create. Same pattern as
+                    // seedTenant.ts. On a re-replay (rebuild) do not bump the version.
                     const streamVersion = await getUnscopedAggregateStreamMaxVersion(rawDb, aggregateId);
                     // skip: idempotent — tier-assignment stream already seeded (rebuild/replay).
                     if (streamVersion > 0)
                         return;
-                    // SystemUser für den NEUEN tenant — der Hook wird vom signup-
-                    // user (anderer tenant, oder SystemAdmin) ausgelöst, aber das
-                    // tier-assignment muss im stream des neu-erzeugten tenants
-                    // landen (= aggregate-id deterministic auf newTenantId). Memory
-                    // `feedback_event_store_tenant_consistency`: by.tenantId muss =
-                    // ziel-tenant.
+                    // SystemUser for the NEW tenant — the hook is triggered by the signup
+                    // user (another tenant, or SystemAdmin), but the tier-assignment has
+                    // to land in the stream of the newly created tenant (= aggregate id
+                    // deterministic on newTenantId). Memory
+                    // `feedback_event_store_tenant_consistency`: by.tenantId must equal
+                    // the target tenant.
                     const systemUser = {
                         id: "00000000-0000-4000-8000-000000000001",
                         tenantId: newTenantId,
                         roles: ["SystemAdmin"],
                     };
-                    const tdb = createTenantDb(rawDb, newTenantId, "system");
+                    const tdb = createTenantDb({ db: rawDb, tenantId: newTenantId, mode: "system" });
                     await tierAssignmentExecutor.create({ id: aggregateId, tier: defaultTier, source: TierAssignmentSources.default }, systemUser, tdb);
                 },
                 phase: HookPhases.inTransaction,
                 escapeHatch: { reason: autoDefaultTierHookReason },
             });
         }
-        // Extension-point declaration + self-registration. Pattern analog
-        // mail-foundation/file-foundation: das feature deklariert den
-        // extension-point UND registriert sich als default-plugin. Andere
-        // features könnten später auch dort registrieren (z.B. ein future
-        // toggle-only-resolver), aber nur ein plugin gewinnt — siehe
-        // findTierResolverUsage's "single-plugin"-comment.
+        // Extension-point declaration + self-registration. Same pattern as
+        // mail-foundation/file-foundation: the feature declares the extension
+        // point AND registers itself as the default plugin. Other features could
+        // register there later (e.g. a future toggle-only resolver), but only one
+        // plugin wins — see the "single-plugin" comment on findTierResolverUsage.
         r.extendsRegistrar(TENANT_TIER_RESOLVER_EXT, { onRegister: () => { } });
         // Plugin-registration: framework's runDevApp/runProdApp picks this up
         // post-stack-setup, calls build(deps), wires effectiveFeatures.
         const plugin = {
             build: async (deps) => {
-                // Always-on-Set: alle non-toggleable features im registry. Canonical
-                // Kumiko-pattern (matches feature-toggles' resolver): nur features
-                // die explizit `r.toggleable()` registrieren sind tier-cuttable.
-                // Framework-base-features (auth-email-password, config, user, tenant,
-                // sessions, etc.) sind non-toggleable → IMMER aktiv für jeden Tenant
-                // unabhängig vom tier. Sonst würde dispatcher 403 auf login-handler
-                // werfen weil "feature auth-email-password disabled".
+                // Always-on set: all non-toggleable features in the registry. Canonical
+                // Kumiko pattern (matches the feature-toggles resolver): only features
+                // that explicitly register `r.toggleable()` are tier-cuttable.
+                // Framework base features (auth-email-password, config, user, tenant,
+                // sessions, etc.) are non-toggleable → ALWAYS active for every tenant
+                // regardless of tier. Otherwise the dispatcher would answer 403 on the
+                // login handler because "feature auth-email-password disabled".
                 const computedAlwaysOn = new Set();
                 for (const feature of deps.registry.features.values()) {
                     if (feature.toggleableDefault === undefined)
@@ -452,16 +452,16 @@ export function createTierEngineFeature(opts = {}) {
                 // Synchronous resolver-callback for dispatcher hot-path.
                 const resolver = (tenantId) => {
                     // Operator-tooling + async-event-dispatch convention: SYSTEM_TENANT_ID
-                    // gets the union of all tier-features (siehe DispatcherOptions doc).
+                    // gets the union of all tier features (see DispatcherOptions doc).
                     if (tenantId === SYSTEM_TENANT_ID) {
                         return mergeAlwaysOn(computedAlwaysOn, unionAllTierFeatures(tierMap));
                     }
-                    // Cache-miss: tenant ist noch nicht im cache (z.B. brandneu nach
-                    // boot, oder defaultTier-hook hat noch nicht gefired). Default-Set
-                    // ist least-privileged — typisch Free-Tier-features. Memory
-                    // `feedback_security_default_on`: secure-by-default. Der Trial wird
-                    // hier NICHT addiert (sync/boot-cached sieht den Zeitablauf nicht) —
-                    // das macht der trialGate unten am disabled-Gate-Pfad.
+                    // Cache miss: the tenant is not in the cache yet (e.g. brand new after
+                    // boot, or the defaultTier hook has not fired yet). The default set
+                    // is least-privileged — typically free-tier features. Memory
+                    // `feedback_security_default_on`: secure by default. The trial is NOT
+                    // added here (sync/boot-cached, cannot see the passage of time) — the
+                    // trialGate below does that on the disabled-gate path.
                     const fallbackTier = opts.defaultTier;
                     return (cache.get(tenantId) ??
                         (fallbackTier === undefined
@@ -471,11 +471,11 @@ export function createTierEngineFeature(opts = {}) {
                 const trial = opts.trial;
                 if (trial === undefined)
                     return resolver;
-                // Live-Trial-Gate: liest tenant.inserted_at (≈ Signup, existiert für
-                // JEDEN Tenant inkl. auth-signup via seedTenant — anders als die
-                // tier-assignment-Row, die der seed-Pfad nicht anlegt) und prüft das
-                // Fenster gegen die aktuelle Zeit. Nur auf dem disabled-Gate-Pfad
-                // konsultiert. inserted_at ist immutable → pro Tenant einmal lesen.
+                // Live trial gate: reads tenant.inserted_at (≈ signup; exists for EVERY
+                // tenant incl. auth-signup via seedTenant — unlike the tier-assignment
+                // row, which the seed path does not create) and checks the window
+                // against the current time. Consulted only on the disabled-gate path.
+                // inserted_at is immutable → read once per tenant.
                 // Promise-memo (not a plain value cache): N concurrent requests for the
                 // same fresh tenant must await the SAME in-flight fetchOne, not each
                 // fire their own — a plain `Map<TenantId, number>` set AFTER the await
@@ -496,8 +496,8 @@ export function createTierEngineFeature(opts = {}) {
                         startedMemo.set(tenantId, startedMsPromise);
                     }
                     const startedMs = await startedMsPromise;
-                    // Tenant-Row noch nicht projiziert (Replay-Race) → keinen Miss
-                    // memoizen, beim nächsten Request neu lesen.
+                    // Tenant row not projected yet (replay race) → do not memoize the
+                    // miss, re-read on the next request.
                     if (startedMs === undefined) {
                         startedMemo.delete(tenantId);
                         return false;
@@ -509,14 +509,7 @@ export function createTierEngineFeature(opts = {}) {
         };
         // biome-ignore lint/correctness/useHookAtTopLevel: r.useExtension is a framework registrar method, not a React hook.
         r.useExtension(TENANT_TIER_RESOLVER_EXT, TIER_ENGINE_FEATURE, plugin);
-    });
+    }, Object.keys(opts).length === 0 ? { dedupeOptions: {} } : undefined);
 }
-/**
- * Legacy named export — equivalent to `createTierEngineFeature()` ohne opts.
- * Storage-only mode (no resolver, no auto-default). Existing apps die
- * `tierEngineFeature` referenzieren bekommen identical behavior.
- *
- * Migration zu `createTierEngineFeature({ defaultTier, tierMap })` gibt
- * volle Tier-Composition (Sprint-8a Pattern).
- */
+/** @deprecated Use createTierEngineFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export const tierEngineFeature = createTierEngineFeature();

package/dist/tier-engine/handlers/get-tenant-tier.query.js

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { buildEntityTable, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { buildEntityTable, createTenantDb, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { tierAssignmentEntity } from "../entity.js";
@@ -20,7 +19,7 @@ export const getTenantTierQuery = defineQueryHandler({
     },
     handler: async (query, ctx) => {
         const tenantId = query.payload.tenantId; // @cast-boundary engine-bridge
-        const tdb = createTenantDb(ctx.db.unsafeRaw(), tenantId, "system");
+        const tdb = createTenantDb({ db: ctx.db.unsafeRaw(), tenantId, mode: "system" });
         const row = await fetchOne(tdb, tierAssignmentTable, { tenantId });
         return row ?? null;
     },

package/dist/tier-engine/handlers/set-tenant-tier.write.js

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { buildEntityTable, createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { buildEntityTable, createEventStoreExecutor, fetchOne, } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { requireForTenant } from "../../shared/index.js";

package/dist/user/db/queries/stream-tenant-backfill.js

@@ -23,7 +23,7 @@
 // After a run, rebuild the user projection so read_users.tenant_id reflects
 // the stream move: rebuildProjection("user:projection:user-entity", ...) or
 // the jobs:job:projection-rebuild job.
-import { asRawClient, transaction, unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient, transaction, unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 export async function backfillUserStreamTenants(db) {
     const candidates = await unsafeReadRetrying(db, `SELECT DISTINCT "aggregate_id" FROM "kumiko_events"

package/dist/user/handlers/create.write.js

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, findForbiddenRoleAssignment, } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, ConflictError, InternalError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { canonicalizeLocaleTag, isValidLocaleTag } from "@cosmicdrift/kumiko-framework/i18n";

package/dist/user/handlers/find-for-auth.query.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/dist/user/handlers/list.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineEntityListHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 // kumiko-lint-ignore cross-feature-import SystemAdmin user-list joins memberships for tenants column

package/dist/user/handlers/update-roles.js

@@ -1,5 +1,4 @@
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { acquireNamespacedAdvisoryLock, createEventStoreExecutor, } from "@cosmicdrift/kumiko-framework/db";
+import { acquireNamespacedAdvisoryLock, createEventStoreExecutor, fetchOne, selectMany, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, findForbiddenRoleAssignment, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, ConflictError, InternalError, NotFoundError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";

package/dist/user/index.d.ts

@@ -2,7 +2,7 @@ export { UserCommandSchemas } from "./command-schemas.js";
 export { USER_FEATURE, UserErrors, UserHandlers, UserQueries } from "./constants.js";
 export { backfillUserStreamTenants, type UserStreamBackfillResult, } from "./db/queries/stream-tenant-backfill.js";
 export { createUserFeature } from "./feature.js";
-export { isPrincipalBlocked, principalStatusPlugin } from "./principal-status.js";
+export { isPrincipalBlocked, isPrincipalRowBlocked, principalStatusPlugin, } from "./principal-status.js";
 export { resolveUserDisplayNames } from "./resolve-display-names.js";
 export type { UserStatus } from "./schema/user.js";
 export { USER_ANONYMIZED_DISPLAY_NAME, USER_ANONYMIZED_EMAIL_DOMAIN, USER_ANONYMIZED_EMAIL_PREFIX, USER_DELETED_DISPLAY_NAME, USER_DELETED_EMAIL_PREFIX, USER_STATUS, userEntity, userTable, } from "./schema/user.js";

package/dist/user/index.js

@@ -2,6 +2,6 @@ export { UserCommandSchemas } from "./command-schemas.js";
 export { USER_FEATURE, UserErrors, UserHandlers, UserQueries } from "./constants.js";
 export { backfillUserStreamTenants, } from "./db/queries/stream-tenant-backfill.js";
 export { createUserFeature } from "./feature.js";
-export { isPrincipalBlocked, principalStatusPlugin } from "./principal-status.js";
+export { isPrincipalBlocked, isPrincipalRowBlocked, principalStatusPlugin, } from "./principal-status.js";
 export { resolveUserDisplayNames } from "./resolve-display-names.js";
 export { USER_ANONYMIZED_DISPLAY_NAME, USER_ANONYMIZED_EMAIL_DOMAIN, USER_ANONYMIZED_EMAIL_PREFIX, USER_DELETED_DISPLAY_NAME, USER_DELETED_EMAIL_PREFIX, USER_STATUS, userEntity, userTable, } from "./schema/user.js";

package/dist/user/invited-global-roles.js

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb, fetchOne, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
@@ -25,7 +24,7 @@ export async function grantInvitedGlobalRoles(db, options) {
     if (missingRoles.length === 0)
         return grantedGlobalRoles(currentRoles);
     const roles = [...currentRoles, ...missingRoles];
-    const updateResult = await userExecutor.update({ id: existing.id, version: existing.version, changes: { roles } }, createSystemUser(SYSTEM_TENANT_ID), createTenantDb(db, SYSTEM_TENANT_ID, "system"));
+    const updateResult = await userExecutor.update({ id: existing.id, version: existing.version, changes: { roles } }, createSystemUser(SYSTEM_TENANT_ID), createTenantDb({ db, tenantId: SYSTEM_TENANT_ID, mode: "system" }));
     if (!updateResult.isSuccess)
         return updateResult;
     return grantedGlobalRoles(roles);

package/dist/user/principal-status.d.ts

@@ -1,4 +1,8 @@
 import type { PrincipalStatusPlugin } from "@cosmicdrift/kumiko-framework/engine";
 import { type UserStatus } from "./schema/user.js";
 export declare function isPrincipalBlocked(status: UserStatus): boolean;
+export declare function isPrincipalRowBlocked(row: {
+    readonly status: UserStatus;
+    readonly isDeleted: boolean;
+}): boolean;
 export declare const principalStatusPlugin: PrincipalStatusPlugin;

package/dist/user/principal-status.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { USER_STATUS, userTable } from "./schema/user.js";
 // Locked accounts whose live sessions must be refused. deletionRequested is
@@ -12,14 +12,20 @@ const BLOCKED_STATUSES = new Set([
 export function isPrincipalBlocked(status) {
     return BLOCKED_STATUSES.has(status);
 }
+// A soft-deleted row (executor.delete) keeps its last status, so isDeleted must block on its own.
+export function isPrincipalRowBlocked(row) {
+    return row.isDeleted || isPrincipalBlocked(row.status);
+}
 // Registered via r.useExtension(EXT_PRINCIPAL_STATUS, "user", principalStatusPlugin)
 // so resolveActiveMembershipFn can reject a blocked principal without knowing about `user`'s table.
 export const principalStatusPlugin = {
     async resolveStatus(userId, { db }) {
-        const row = await fetchOne(db, userTable, { id: userId });
+        const row = await fetchOne(db, userTable, {
+            id: userId,
+        });
         if (!row)
             return "unknown";
-        return isPrincipalBlocked(row.status) ? "blocked" : "active";
+        return isPrincipalRowBlocked(row) ? "blocked" : "active";
     },
     // ctx.queryAsMember's global-roles/timezone/locale source — same fields
     // login mints a session from (see login.write.ts gateBuildSession).

package/dist/user/resolve-display-names.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { decryptStoredPii, mapWithConcurrency } from "../shared/index.js";
 import { userTable } from "./schema/user.js";
 // Shares the KMS adapter's small dedicated pool, same as member-directory.

package/dist/user/seeding.js

@@ -9,10 +9,9 @@
 // umgehen, also kein `user.created`-Event und keine MSP-Konsumenten
 // (audit, search-index) sehen den Seed. Der Executor-Pfad emittiert
 // das Event UND schreibt die Projection-Zeile in einer TX.
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { computeBlindIndex, configuredBlindIndexKey } from "@cosmicdrift/kumiko-framework/crypto";
-import { createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-framework/db";
-import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
+import { createEventStoreExecutor, createTenantDb, fetchOne, } from "@cosmicdrift/kumiko-framework/db";
+import { TestUsers } from "@cosmicdrift/kumiko-framework/seeding";
 // kumiko-lint-ignore cross-feature-import shares the postSave-hooks fixture contract with tenant/seeding (#1478)
 import { fireEntityPostSave } from "../tenant/seeding.js";
 import { userEntity, userTable } from "./schema/user.js";
@@ -32,7 +31,7 @@ hooks) {
     // executor.create erwartet eine TenantDb (mit .insert()-API). User
     // ist zwar tenant-agnostic (kein tenant_id-Spalte), aber das runtime-
     // Interface braucht den Wrap.
-    const tdb = createTenantDb(db, by.tenantId, "system");
+    const tdb = createTenantDb({ db, tenantId: by.tenantId, mode: "system" });
     const existing = await fetchOne(db, userTable, { email: options.email, isDeleted: false });
     // @cast-boundary db-row: users.id ist uuid-Spalte (string), fetchOne
     // liefert die Projection-Row als Record<string, unknown>.
@@ -66,7 +65,7 @@ export async function reconcileSeededUserEmailVerified(db, existingRow, by) {
     // @cast-boundary db-row: users.id ist uuid-Spalte (string), fetchOne
     // liefert die Projection-Row als Record<string, unknown>.
     const id = existingRow["id"];
-    const tdb = createTenantDb(db, by.tenantId, "system");
+    const tdb = createTenantDb({ db, tenantId: by.tenantId, mode: "system" });
     const result = await userExecutor.update({ id, version: existingRow["version"], changes: { emailVerified: true } }, by, tdb);
     // version_conflict = a concurrent write already changed the row —
     // fine for a seed helper, don't fail the whole seed run over it.
@@ -101,7 +100,7 @@ export async function rewriteSeededUserEmail(db, existingRow, email, by) {
         if (indexed)
             return;
     }
-    const tdb = createTenantDb(db, by.tenantId, "system");
+    const tdb = createTenantDb({ db, tenantId: by.tenantId, mode: "system" });
     const result = await userExecutor.update({ id, version, changes: { email } }, by, tdb);
     // version_conflict: a concurrent write already changed the row — fine for a seed helper.
     // unique_violation: a duplicate row already holds the blind index; the repair

package/dist/user-data-rights/audit-download.js

@@ -29,7 +29,7 @@ const attemptCrud = createEventStoreExecutor(downloadAttemptsTable, downloadAtte
 export async function recordDownloadUse(args) {
     const { db, tokenId, tokenVersion, tokenUseCount, tenantId, now, ip, userAgent } = args;
     const executor = createSystemUser(tenantId);
-    const tdb = createTenantDb(db, tenantId, "system");
+    const tdb = createTenantDb({ db, tenantId, mode: "system" });
     await tokenCrud
         .update({
         id: tokenId,
@@ -53,7 +53,7 @@ export async function recordDownloadUse(args) {
 export async function recordInvalidAttempt(args) {
     const { db, tenantId, now } = args;
     const executor = createSystemUser(tenantId);
-    const tdb = createTenantDb(db, tenantId, "system");
+    const tdb = createTenantDb({ db, tenantId, mode: "system" });
     await attemptCrud
         .create({
         result: args.result,

package/dist/user-data-rights/db/queries/export-jobs.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { exportJobsTable } from "../../schema/export-job.js";
 // @wrapper-known semantic-alias
 export async function selectExportJobsForStorageCleanup(db, doneStatus, failedStatus) {

package/dist/user-data-rights/db/queries/forget-cleanup.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { userTable } from "../../../user/index.js";
 export async function selectUsersDueForForgetCleanup(db, status, gracePeriodEndCutoff) {

package/dist/user-data-rights/feature.js

@@ -521,15 +521,18 @@ export function createUserDataRightsFeature(opts = {}) {
                     db: forgetDb,
                     userId: forgetUserId,
                 });
-                // Without an app callback the default mail goes out when a mail transport and a
-                // mail renderer are mounted. The user is already erased here, so it bypasses the
-                // delivery log: an attempt row would be new personal data.
+                // Without an app callback the default mail goes out when an email channel or a
+                // mail transport, plus a mail renderer, are mounted. The user is already erased
+                // here, so it bypasses the delivery log: an attempt row would be new personal data.
                 const forgetConfigResolver = ctx.configResolver;
                 const sendDeletionExecutedEmail = opts.sendDeletionExecutedEmail ??
-                    (isMailTransportAvailable(forgetRegistry) && isMailRendererAvailable(forgetRegistry)
+                    ((isGdprMailDeliveryAvailable(forgetRegistry) ||
+                        isMailTransportAvailable(forgetRegistry)) &&
+                        isMailRendererAvailable(forgetRegistry)
                         ? makeDefaultDeletionExecutedEmail({
                             registry: forgetRegistry,
                             db: forgetDb,
+                            ...(ctx.secrets !== undefined && { secrets: ctx.secrets }),
                             resolveTransport: makeTenantMailTransportResolver({
                                 registry: forgetRegistry,
                                 configResolver: forgetConfigResolver,

package/dist/user-data-rights/handlers/download-by-job.query.js

@@ -23,7 +23,7 @@
 //   6. Audit-Update: useCount + 1, IP, UA, lastUsedAt (best-effort)
 //   7. Return {url, expiresAt}
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, SYSTEM_USER_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";

package/dist/user-data-rights/handlers/download-by-token.query.js

@@ -25,7 +25,7 @@
 // **r.httpRoute-Wrapper** (siehe feature.ts) macht 302-Redirect zu
 // signedUrl — User klickt 1× Email-Link, Browser folgt redirect, Download
 // startet. Dieser query-handler liefert nur das JSON.
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, SYSTEM_USER_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";

package/dist/user-data-rights/handlers/export-status.query.js

@@ -10,7 +10,7 @@
 //
 // **Read-Only-Endpoint:** Pollt nur, kein State-Flip. Idempotent + cache-
 // fest. UI poll-Intervall typisch 2-5s waehrend running.
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { exportJobsTable } from "../schema/export-job.js";

package/dist/user-data-rights/handlers/list-download-attempts.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";

package/dist/user-data-rights/handlers/my-audit-log.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";

package/dist/user-data-rights/handlers/request-export.write.js

@@ -19,8 +19,7 @@
 // `requestedFromTenantId` persistiert den Initial-Tenant aus dem
 // 1. Klick — Worker liest sein Compliance-Profile aus DIESEM Tenant
 // fuer Job-TTL/Stale/Cleanup.
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import * as z from "zod";

package/dist/user-data-rights/handlers/run-forget-cleanup.write.js

@@ -9,7 +9,7 @@
 // Setup laeuft der Job mit `createSystemUser(...)` als executor.
 //
 // Rueckgabe: Stats fuer Operator-Monitoring (processed-count, error-list).
-import { access, defineWriteHandler, SYSTEM_USER_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import * as z from "zod";
@@ -46,7 +46,7 @@ export function createRunForgetCleanupHandler(opts = {}) {
                 registry: ctx.registry,
                 configResolver: ctx.configResolver,
                 db: forgetDb,
-                userId: ctx._userId ?? SYSTEM_USER_ID,
+                userId: ctx.user.id,
             });
             const result = await runForgetCleanup({
                 db: runner,
@@ -59,7 +59,7 @@ export function createRunForgetCleanupHandler(opts = {}) {
                     configResolver: ctx.configResolver,
                     secrets: ctx.secrets,
                     db: forgetDb,
-                    userId: ctx._userId ?? SYSTEM_USER_ID,
+                    userId: ctx.user.id,
                     handlerName: "user-data-rights:run-forget-cleanup",
                 }),
                 ...(opts.sendDeletionExecutedEmail && {