@cosmicdrift/kumiko-bundled-features 0.367.0 → 0.369.0

package/dist/user-data-rights/lib/default-mailers.d.ts

@@ -1,6 +1,7 @@
 import type { EmailTransport } from "@cosmicdrift/kumiko-bundled-features/channel-email";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { ConfigAccessor, NotifyFn, Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import { type GdprMailLocale } from "../email-templates.js";
 import type { SendDeletionRequestedEmailFn } from "../handlers/request-deletion.write.js";
 import type { SendExportFailedEmailFn, SendExportReadyEmailFn } from "../run-export-jobs.js";
@@ -19,7 +20,9 @@ export declare function makeDefaultDeletionRequestedEmail(notify: NotifyFn, defa
 export type DeletionExecutedMailDeps = {
     readonly registry: Registry;
     readonly db: DbConnection;
+    /** Used only when no email delivery channel is mounted. */
     readonly resolveTransport: (tenantId: string) => Promise<EmailTransport>;
     readonly configFor: (tenantId: TenantId) => ConfigAccessor | undefined;
+    readonly secrets?: SecretsContext;
 };
 export declare function makeDefaultDeletionExecutedEmail(deps: DeletionExecutedMailDeps, defaults?: GdprMailDefaults): SendDeletionExecutedEmailFn;

package/dist/user-data-rights/lib/default-mailers.js

@@ -7,11 +7,11 @@
 // to the user, so delivery resolves the address and the attempt row carries
 // the recipientId the forget path erases. Deletion-executed cannot: the user
 // is gone by then, and an attempt row written after the erasure would be new
-// personal data. It renders the seeded template and sends over the tenant's
-// mail transport, with no delivery log.
+// personal data. It renders the seeded template and sends it straight through the
+// email channel (or, without one, the tenant's mail transport), with no delivery log.
 import { MAIL_TRANSPORT_EXTENSION } from "@cosmicdrift/kumiko-bundled-features/mail-foundation";
 import { hasMailTranslations, mailT } from "@cosmicdrift/kumiko-framework/i18n";
-import { DELIVERY_CHANNEL_EXTENSION } from "../../delivery/index.js";
+import { buildChannelContext, collectChannels, DELIVERY_CHANNEL_EXTENSION, EMAIL_CHANNEL_NAME, } from "../../delivery/index.js";
 import { collectRendererPlugins, createRendererFoundationApi, } from "../../renderer-foundation/index.js";
 import { formatGdprMailTimestamp, normalizeGdprMailLocale, } from "../email-templates.js";
 import { GdprMailNotificationTypes, gdprMailTemplateLocale } from "../mail-notifications.js";
@@ -88,6 +88,9 @@ export function makeDefaultDeletionRequestedEmail(notify, defaults = {}) {
         });
     };
 }
+function emailChannelOf(registry) {
+    return collectChannels(registry).find((channel) => channel.name === EMAIL_CHANNEL_NAME);
+}
 export function makeDefaultDeletionExecutedEmail(deps, defaults = {}) {
     return async (args) => {
         // Der User ist global, der Mail-Transport per-Tenant — wir senden ueber den
@@ -121,6 +124,25 @@ export function makeDefaultDeletionExecutedEmail(deps, defaults = {}) {
         if (rendered.kind !== "mail") {
             throw new Error(`deletion-executed mail: renderer answered with kind "${rendered.kind}"`);
         }
+        // The channel picks the same transport as every other mail of this notification
+        // (the app transport unless it is declared tenantTransport), so a tenant without
+        // its own mail provider still gets the confirmation. channel.send writes no attempt row.
+        const channel = emailChannelOf(deps.registry);
+        if (channel !== undefined) {
+            const result = await channel.send(args.userEmail, {
+                notificationType: type,
+                title: rendered.subject,
+                body: undefined,
+                data: undefined,
+                locale,
+            }, buildChannelContext(deps.db, deps.registry, undefined, tenantId, deps.secrets, config), { subject: rendered.subject, html: rendered.html, text: rendered.text });
+            if (result.status !== "sent") {
+                // No address in the message: the user is already erased.
+                throw new Error(`deletion-executed mail not sent: ${result.error ?? result.status}`);
+            }
+            // skip: the channel delivered it, the transport fallback below is for apps without one
+            return;
+        }
         const transport = await deps.resolveTransport(tenantId);
         await transport.send({
             to: args.userEmail,

package/dist/user-data-rights/lib/deny-if-target-outside-admin-tenant.d.ts

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import { type WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
 export declare const TARGET_USER_NOT_IN_ADMIN_TENANT: "target_user_not_in_admin_tenant";

package/dist/user-data-rights/lib/deny-if-target-outside-admin-tenant.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { AccessDeniedError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { tenantMembershipsTable } from "../../tenant/index.js";
 import { isSystemAdminActor } from "./is-admin-actor.js";

package/dist/user-data-rights/lib/update-user-lifecycle.d.ts

@@ -3,6 +3,7 @@ import { type WritePurpose } from "@cosmicdrift/kumiko-framework/db";
 export type UpdateUserLifecycleOptions = {
     readonly expect?: Readonly<Record<string, string | number | boolean | null>>;
     readonly writePurpose?: WritePurpose;
+    readonly includeDeleted?: boolean;
 };
 export declare function updateUserLifecycle(conn: DbRunner, userId: string, changes: Record<string, unknown>, options?: UpdateUserLifecycleOptions): Promise<{
     readonly applied: boolean;

package/dist/user-data-rights/lib/update-user-lifecycle.js

@@ -1,5 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb, selectMany, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { USER_STATUS, userEntity, userTable } from "../../user/index.js";
@@ -38,11 +37,12 @@ export async function updateUserLifecycle(conn, userId, changes, options) {
     // (restrict/lift-restriction/grace-period/cancel/forget) that holds no row
     // version to pass as `payload.version`, which update() requires otherwise.
     // Callers needing a guard use `options.expect` instead.
-    const tenantDb = createTenantDb(conn, SYSTEM_TENANT_ID, "system");
+    const tenantDb = createTenantDb({ db: conn, tenantId: SYSTEM_TENANT_ID, mode: "system" });
     const result = await userExecutor.update({ id: userId, changes }, createSystemUser(SYSTEM_TENANT_ID), tenantDb, {
         skipOptimisticLock: true,
         ...(options?.expect && { expect: options.expect }),
         ...(options?.writePurpose && { writePurpose: options.writePurpose }),
+        ...(options?.includeDeleted && { includeDeleted: true }),
     });
     if (result.isSuccess)
         return { applied: true };

package/dist/user-data-rights/run-export-jobs.js

@@ -43,10 +43,9 @@
 // **Storage-Cleanup:** dritter Pass loescht abgelaufene downloadStorageKeys
 // (`expiresAt + exportStorageCleanupGraceHours < now`) — abgelaufene ZIPs
 // auf S3 sollen nicht ewig liegen.
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { addDurationSpec } from "@cosmicdrift/kumiko-framework/compliance";
 import { PII_ERASED_SENTINEL } from "@cosmicdrift/kumiko-framework/crypto";
-import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb, fetchOne, selectMany, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser } from "@cosmicdrift/kumiko-framework/engine";
 import { createZipStream, tenantExportPrefix, } from "@cosmicdrift/kumiko-framework/files";
 import { resolveProfileForTenant } from "../compliance-profiles/index.js";
@@ -547,7 +546,7 @@ function reportCleanupLastRun(metrics, now) {
 // Stream-Counter konsistent bleibt (Memory feedback_event_store_tenant_consistency).
 // @wrapper-known semantic-alias
 function systemTenantDb(db, tenantId) {
-    return createTenantDb(db, tenantId, "system");
+    return createTenantDb({ db, tenantId, mode: "system" });
 }
 function buildExportStorageKey(job) {
     return `${tenantExportPrefix(job.requestedFromTenantId)}${job.id}.zip`;

package/dist/user-data-rights/run-forget-cleanup.js

@@ -34,9 +34,8 @@ import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 // gesammelt + zurueckgegeben fuer Operator-Visibility. Ein User mit
 // gefailten Hooks bleibt im DeletionRequested-Status (next Lauf
 // retried automatisch).
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
-import { createTenantDb, entityEventName, executeRawQuery, nullBlindIndexesForSubject, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
+import { createTenantDb, entityEventName, executeRawQuery, fetchOne, nullBlindIndexesForSubject, selectMany, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
 import { EXT_USER_DATA, EXT_USER_DATA_ORDER, extensionUsageEscapeHatchReason, } from "@cosmicdrift/kumiko-framework/engine";
 import { createEscapeHatchReporter, UNATTRIBUTED_ACTOR, } from "@cosmicdrift/kumiko-framework/pipeline";
 import { purgeSearchDocumentsForSubject, } from "@cosmicdrift/kumiko-framework/search";
@@ -54,9 +53,14 @@ function buildHookDb(db, tenantId, entry, args) {
         sink: args.escapeHatchAuditSink,
         log: args.escapeHatchAuditLog ?? createFallbackLogger("user-data-rights"),
     });
-    return createTenantDb(db, tenantId, "tenant", undefined, undefined, undefined, {
-        unsafeRaw: entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
-        report,
+    return createTenantDb({
+        db,
+        tenantId,
+        mode: "tenant",
+        grants: {
+            unsafeRaw: entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
+            report,
+        },
     });
 }
 // EXT_USER_DATA delete-hooks default here; a hook that redacts data keyed on an

package/dist/user-data-rights/run-user-export.js

@@ -20,9 +20,8 @@ import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 // **PII-Surface:** Hooks definieren selbst welche Felder ins Bundle
 // landen. user-data-rights-defaults/hooks/user.userdata-hook expose
 // expliziert KEIN passwordHash + KEINE roles (privileged columns).
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, } from "@cosmicdrift/kumiko-framework/crypto";
-import { collectEncryptedFieldNames, configuredEntityFieldEncryption, createTenantDb, decryptEntityFieldValues, } from "@cosmicdrift/kumiko-framework/db";
+import { collectEncryptedFieldNames, configuredEntityFieldEncryption, createTenantDb, decryptEntityFieldValues, selectMany, } from "@cosmicdrift/kumiko-framework/db";
 import { EXT_USER_DATA, extensionUsageEscapeHatchReason, maskWriteOnlyFields, } from "@cosmicdrift/kumiko-framework/engine";
 import { createEscapeHatchReporter, UNATTRIBUTED_ACTOR, } from "@cosmicdrift/kumiko-framework/pipeline";
 import { tenantMembershipsTable } from "../tenant/index.js";
@@ -35,9 +34,14 @@ function buildHookDb(db, tenantId, entry, args) {
         sink: args.escapeHatchAuditSink,
         log: args.escapeHatchAuditLog ?? createFallbackLogger("user-data-rights"),
     });
-    return createTenantDb(db, tenantId, "tenant", undefined, undefined, undefined, {
-        unsafeRaw: entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
-        report,
+    return createTenantDb({
+        db,
+        tenantId,
+        mode: "tenant",
+        grants: {
+            unsafeRaw: entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
+            report,
+        },
     });
 }
 /**

package/dist/waitlist/handlers/invite.write.js

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { acquireNamespacedAdvisoryLock } from "@cosmicdrift/kumiko-framework/db";
+import { acquireNamespacedAdvisoryLock, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, defineWriteHandler, parseTenantId, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";

package/dist/waitlist/handlers/reject.write.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, defineWriteHandler, parseTenantId, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { cancelPendingInvitation, INVITATION_STATUS, tenantInvitationsTable, } from "../../tenant/index.js";

package/dist/waitlist/lib.js

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, fetchOne, } from "@cosmicdrift/kumiko-framework/db";
 import { access, createSystemUser, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { tenantMembershipsTable } from "../tenant/index.js";

package/dist/workflow-runner/event-subscriber.js

@@ -23,7 +23,7 @@
 // + triggerEventRef + wakeAt=now() onto the matching pending row(s); the
 // existing resume-due-runs job (Phase 2) picks the row up on its next
 // cron tick — the one resume path stays exactly the one Phase 2 built.
-import { selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany, updateMany } from "@cosmicdrift/kumiko-framework/db";
 import { evaluateEventMatch } from "@cosmicdrift/kumiko-framework/engine";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";

package/dist/workflow-runner/feature.d.ts

@@ -1,3 +1,7 @@
+export declare function createWorkflowRunnerFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: void;
+};
+/** @deprecated Use createWorkflowRunnerFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const workflowRunnerFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };

package/dist/workflow-runner/feature.js

@@ -32,45 +32,49 @@ import { workflowRunPendingTableMeta } from "./tables.js";
 // bundled feature's runtime name follows this convention, and
 // use-all-bundled's check-coverage matches exports to mounted features by it.
 const FEATURE_NAME = "workflow-runner";
-export const workflowRunnerFeature = defineFeature(FEATURE_NAME, (r) => {
-    r.describe("Writes the run-envelope (`workflow.run-started` / `workflow.run-completed` / `workflow.run-failed`) for a workflow run onto its `workflow-run` aggregate stream. Provides `startAndRunWorkflow` and `registerEventTrigger` for consumer features to wire up `defineWorkflow`-based workflows against domain events. Registers no workflows itself. Runs the resume loop for suspended `wait`/`retry`/`waitForEvent` steps (`resume-due-runs` job + `resume-run` handler); `registerEventTrigger` wires an event-wakeup subscriber per workflow that declares `awaits` so a `waitForEvent` step resumes as soon as its awaited event arrives, not just on timeout.");
-    r.uiHints({
-        displayLabel: "Workflow Runner",
-        category: "infrastructure",
-        recommended: false,
-    });
-    // resume-run needs a full HandlerContext + ctx.systemDb (the pending-row
-    // scan crosses whatever tenant the row belongs to relative to the job's
-    // own tenant loop iteration) — same reasoning as tenant/feature.ts.
-    r.systemScope();
-    r.storeTable(workflowRunPendingTableMeta, {
-        reason: "resume_loop.pending_suspended_steps",
-    });
-    registerWorkflowRunPendingProjection(r);
-    r.writeHandler(resumeRunHandler);
-    r.job("resume-due-runs", { trigger: { cron: "* * * * *" }, perTenant: true, concurrency: "skip" }, async (_payload, ctx) => {
-        if (!ctx.systemDb) {
-            throw new Error("resume-due-runs: ctx.systemDb required (r.systemScope() feature)");
-        }
-        const tenantId = ctx.systemUser?.tenantId ?? ctx._tenantId;
-        if (tenantId === undefined) {
-            // skip: cron fired without a perTenant fan-out tenant — nothing scoped
-            return;
-        }
-        const dueRows = await selectDueWorkflowRunPending(ctx.systemDb.assertTenantMatch(tenantId));
-        for (const row of dueRows) {
-            try {
-                await ctx.write("workflow-runner:write:resume-run", {
-                    runId: row.runId,
-                    stepIndex: row.stepIndex,
-                });
+export function createWorkflowRunnerFeature() {
+    return defineFeature(FEATURE_NAME, (r) => {
+        r.describe("Writes the run-envelope (`workflow.run-started` / `workflow.run-completed` / `workflow.run-failed`) for a workflow run onto its `workflow-run` aggregate stream. Provides `startAndRunWorkflow` and `registerEventTrigger` for consumer features to wire up `defineWorkflow`-based workflows against domain events. Registers no workflows itself. Runs the resume loop for suspended `wait`/`retry`/`waitForEvent` steps (`resume-due-runs` job + `resume-run` handler); `registerEventTrigger` wires an event-wakeup subscriber per workflow that declares `awaits` so a `waitForEvent` step resumes as soon as its awaited event arrives, not just on timeout.");
+        r.uiHints({
+            displayLabel: "Workflow Runner",
+            category: "infrastructure",
+            recommended: false,
+        });
+        // resume-run needs a full HandlerContext + ctx.systemDb (the pending-row
+        // scan crosses whatever tenant the row belongs to relative to the job's
+        // own tenant loop iteration) — same reasoning as tenant/feature.ts.
+        r.systemScope();
+        r.storeTable(workflowRunPendingTableMeta, {
+            reason: "resume_loop.pending_suspended_steps",
+        });
+        registerWorkflowRunPendingProjection(r);
+        r.writeHandler(resumeRunHandler);
+        r.job("resume-due-runs", { trigger: { cron: "* * * * *" }, perTenant: true, concurrency: "skip" }, async (_payload, ctx) => {
+            if (!ctx.systemDb) {
+                throw new Error("resume-due-runs: ctx.systemDb required (r.systemScope() feature)");
             }
-            catch (error) {
-                // skip: one row's dispatch failing (infra hiccup, not a business
-                // outcome — resume-run itself never throws for expected cases)
-                // must not stop the rest of this tenant's due rows from resuming.
-                ctx.log.warn(`[workflow-runner:resume-due-runs] runId=${row.runId} stepIndex=${row.stepIndex} dispatch failed: ${String(error)}`);
+            const tenantId = ctx.systemUser?.tenantId ?? ctx._tenantId;
+            if (tenantId === undefined) {
+                // skip: cron fired without a perTenant fan-out tenant — nothing scoped
+                return;
             }
-        }
-    });
-});
+            const dueRows = await selectDueWorkflowRunPending(ctx.systemDb.assertTenantMatch(tenantId));
+            for (const row of dueRows) {
+                try {
+                    await ctx.write("workflow-runner:write:resume-run", {
+                        runId: row.runId,
+                        stepIndex: row.stepIndex,
+                    });
+                }
+                catch (error) {
+                    // skip: one row's dispatch failing (infra hiccup, not a business
+                    // outcome — resume-run itself never throws for expected cases)
+                    // must not stop the rest of this tenant's due rows from resuming.
+                    ctx.log.warn(`[workflow-runner:resume-due-runs] runId=${row.runId} stepIndex=${row.stepIndex} dispatch failed: ${String(error)}`);
+                }
+            }
+        });
+    }, { dedupeOptions: {} });
+}
+/** @deprecated Use createWorkflowRunnerFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const workflowRunnerFeature = createWorkflowRunnerFeature();

package/dist/workflow-runner/handlers/resume-run.write.js

@@ -29,7 +29,7 @@
 // pipeline's result for the skipped waitForEvent step itself (see
 // resultKey on steps/wait-for-event.ts) — pre-seeded into stepsAcc below so
 // a subsequent step's resolver can read `ctx.steps[awaits.someKey]`.
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { buildPipelineSteps, computeDefinitionFingerprint, describeWorkflowStepError, getStep, runStepList, SYSTEM_ROLE, unwrapWorkflowStepError, WORKFLOW_AGGREGATE_TYPE, WORKFLOW_RESUMED_TYPE, WORKFLOW_RETRY_SCHEDULED_TYPE, WORKFLOW_RUN_COMPLETED_TYPE, WORKFLOW_RUN_FAILED_TYPE, WORKFLOW_RUN_STARTED_TYPE, WORKFLOW_WAITING_FOR_EVENT_TYPE, WorkflowStepError, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";

package/dist/workflow-runner/index.d.ts

@@ -1,4 +1,4 @@
 export { workflowRunAggregateId } from "./aggregate-id.js";
 export { registerEventTrigger } from "./event-trigger.js";
-export { workflowRunnerFeature } from "./feature.js";
+export { createWorkflowRunnerFeature, workflowRunnerFeature } from "./feature.js";
 export { startAndRunWorkflow, type WorkflowRunCompletedPayload, type WorkflowRunFailedPayload, type WorkflowRunStartedPayload, WorkflowSuspensionUnsupportedError, } from "./runner.js";

package/dist/workflow-runner/index.js

@@ -1,5 +1,5 @@
 // Public API of the workflow-runner bundled-feature.
 export { workflowRunAggregateId } from "./aggregate-id.js";
 export { registerEventTrigger } from "./event-trigger.js";
-export { workflowRunnerFeature } from "./feature.js";
+export { createWorkflowRunnerFeature, workflowRunnerFeature } from "./feature.js";
 export { startAndRunWorkflow, WorkflowSuspensionUnsupportedError, } from "./runner.js";

package/dist/workflow-runner/pending-projection.js

@@ -11,7 +11,7 @@
 // No resume logic here — framework#2513 Phase 2 owns the job that reads
 // this table and dispatches the actual resume. This projection only writes
 // the rows.
-import { deleteMany, fetchOne, upsertOnConflict } from "@cosmicdrift/kumiko-framework/bun-db";
+import { deleteMany, fetchOne, upsertOnConflict } from "@cosmicdrift/kumiko-framework/db";
 import { WORKFLOW_RESUMED_TYPE, WORKFLOW_RETRY_SCHEDULED_TYPE, WORKFLOW_RUN_COMPLETED_TYPE, WORKFLOW_RUN_FAILED_TYPE, WORKFLOW_WAITING_FOR_EVENT_TYPE, WORKFLOW_WAITING_TYPE, } from "@cosmicdrift/kumiko-framework/engine";
 import { workflowRunPendingTable } from "./tables.js";
 async function upsertPending(tx, row) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.367.0",
+  "version": "0.369.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -226,6 +226,10 @@
       "types": "./dist/file-provider-s3/index.d.ts",
       "default": "./dist/file-provider-s3/index.js"
     },
+    "./file-provider-s3/lib": {
+      "types": "./dist/file-provider-s3/lib/index.d.ts",
+      "default": "./dist/file-provider-s3/lib/index.js"
+    },
     "./document-ingest-foundation": {
       "types": "./dist/document-ingest-foundation/index.d.ts",
       "default": "./dist/document-ingest-foundation/index.js"
@@ -524,12 +528,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.367.0",
-    "@cosmicdrift/kumiko-framework": "0.367.0",
-    "@cosmicdrift/kumiko-headless": "0.367.0",
-    "@cosmicdrift/kumiko-renderer": "0.367.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.367.0",
-    "@cosmicdrift/kumiko-types": "0.367.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.369.0",
+    "@cosmicdrift/kumiko-framework": "0.369.0",
+    "@cosmicdrift/kumiko-headless": "0.369.0",
+    "@cosmicdrift/kumiko-renderer": "0.369.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.369.0",
+    "@cosmicdrift/kumiko-types": "0.369.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@tiptap/core": "3.31.3",
@@ -772,6 +776,10 @@
         "types": "./dist/file-provider-s3/index.d.ts",
         "default": "./dist/file-provider-s3/index.js"
       },
+      "./file-provider-s3/lib": {
+        "types": "./dist/file-provider-s3/lib/index.d.ts",
+        "default": "./dist/file-provider-s3/lib/index.js"
+      },
       "./document-ingest-foundation": {
         "types": "./dist/document-ingest-foundation/index.d.ts",
         "default": "./dist/document-ingest-foundation/index.js"
@@ -1078,10 +1086,19 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.367.0",
-    "@cosmicdrift/kumiko-locale-es": "0.367.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.367.0",
+    "@cosmicdrift/kumiko-locale-de": "0.369.0",
+    "@cosmicdrift/kumiko-locale-es": "0.369.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.369.0",
     "jsqr": "^1.4.0",
-    "unpdf": "^1.8.1"
+    "unpdf": "^1.8.1",
+    "@cosmicdrift/kumiko-testing": "0.369.0"
+  },
+  "peerDependencies": {
+    "@cosmicdrift/kumiko-testing": ">=0.366.0 <1.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@cosmicdrift/kumiko-testing": {
+      "optional": true
+    }
   }
 }

package/src/cap-counter/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.368.0",
+    "type": "improvement",
+    "title": "calendarCapReservationHandle consumes a reservation per unit",
+    "detail": "`reserveCalendarCapUsage` now returns `reservationId`. `calendarCapReservationHandle(ctx, reservationId, { capName, periodStartIso })` returns a handle with `consume(units)` (turns reserved units into booked ones, counter unchanged) and `release()` (gives back the unconsumed rest). A handler reserves the worst case before the job is dispatched, the job consumes per written unit, so parallel dispatches can no longer overshoot the hard cap and a retry only counts what was written.\n\n`consume` beyond the still-reserved rest throws `CapReservationOverConsumedError` (422, `cap_reservation_over_consumed`). `consume` against a settle tombstone throws `CapReservationSettledError` (422, `cap_reservation_settled`); `release` against it is a no-op. When the reservation outlived its TTL and was swept, `consume` books the units directly, the way settle does for a missing row, without a hard-cap check."
+  },
+  {
+    "version": "0.368.0",
+    "type": "fix",
+    "title": "Swept or released calendar reservations remember the units consume booked",
+    "detail": "The reservation row now stores `consumed_amount`. A release or the TTL sweep gives back only the unconsumed rest. If units were consumed, it keeps the row as a released tombstone (`released_at` set, `amount` 0) until the tombstone TTL passes, instead of deleting it. A later `settle` subtracts the consumed units from the booking, and a `consume` after the sweep books its units directly and is remembered the same way, so the counter ends at exactly the settled total. `settle` below the consumed units throws `CapSettleBelowConsumedError` (422, `cap_settle_below_consumed`) in every state. Expired released tombstones are deleted by the sweep.",
+    "migration": "Apps with cap-counter generate a migration for the new columns store_cap_reservations.consumed_amount (integer NOT NULL DEFAULT 0) and store_cap_reservations.released_at (kumiko migrate generate)."
+  },
   {
     "version": "0.366.0",
     "type": "fix",

package/src/channel-email/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.369.0",
+    "type": "breaking",
+    "title": "The tenant mail transport applies per notification",
+    "detail": "r.notification(name, { tenantTransport: true }) marks a notification whose mails go through the tenant's own mail transport. channel-email consults its tenantTransport resolver only for these (also under a renamedFrom name); every other notification, such as password reset or sign-in mails, always takes the app transport, even when the tenant has a provider. With tenantTransport set, transport may be omitted: a mail that then has no transport fails with missing_credentials instead of throwing. The template test mail (template-resolver send-test) now gets the tenant config in its channel context and uses the template's notification, so it leaves through the same transport as the real mail.",
+    "migration": "Apps that pass tenantTransport to createChannelEmailFeature add `tenantTransport: true` to every r.notification whose mails should go through the tenant's provider; without the flag those mails now go through the app transport. Apps without an app SMTP server can drop transport and keep tenantTransport."
+  },
   {
     "version": "0.367.0",
     "type": "improvement",

package/src/crypto-shredding/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.368.0",
+    "type": "fix",
+    "title": "forget-subject closes the login door for users whose stream is already deleted",
+    "detail": "forget-subject returned 500 (\"user lifecycle update failed ... not_found\") when the user stream was deleted but the read_users status still read active, leaving sessions and PATs alive. The erasure now appends the status-deleted user.updated event to that stream too, so the login door closes, the handler returns 200 and a read_users rebuild keeps the state."
+  },
   {
     "version": "0.366.0",
     "type": "fix",

package/src/delivery/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.369.0",
+    "type": "improvement",
+    "title": "Unsubscribe links in dev and a reusable result page",
+    "detail": "runDevApp accepts unsubscribe: { secret, tenantOrigin? } like runProdApp, mounts the unsubscribe routes and signs the links (base URL from auth.mail.baseUrl or APP_BASE_URL). Both share resolveUnsubscribeWiring from server-runtime. delivery exports renderUnsubscribeResultPage({ kind: \"unsubscribed\" | \"resubscribed\" | \"failed\", locale, resubscribeToken? }), the page the unsubscribe routes answer with, for apps that serve their own (e.g. legacy) unsubscribe links; without a resubscribeToken it offers no undo button."
+  },
   {
     "version": "0.367.0",
     "type": "improvement",

package/src/file-provider-s3/changes.json

@@ -1 +1,10 @@
-[]
+[
+  {
+    "version": "0.368.0",
+    "type": "breaking",
+    "title": "The S3 file providers merge into createFileProviderS3Feature({ fromEnv })",
+    "detail": "createFileProviderS3Feature() mounts the per-tenant config provider as before. createFileProviderS3Feature({ fromEnv: true }) mounts the env-configured provider (feature name, provider key \"s3-env\" and requires unchanged). The S3 client helpers (createS3Provider, createS3ProviderFromEnv, parseS3EnvConfig, resolveForcePathStyle, S3ProviderConfig) move to the new subpath @cosmicdrift/kumiko-bundled-features/file-provider-s3/lib.\n\nThe subpaths file-provider-s3-env and files-provider-s3 keep working as deprecated re-exports and are removed in the first release after 2026-10-29.\n\nold -> new:\n  fileProviderS3EnvFeature from .../file-provider-s3-env -> createFileProviderS3Feature({ fromEnv: true }) from .../file-provider-s3\n  fileProviderS3Feature -> createFileProviderS3Feature()\n  @cosmicdrift/kumiko-bundled-features/files-provider-s3 -> @cosmicdrift/kumiko-bundled-features/file-provider-s3/lib",
+    "migration": "Run `bun kumiko-upgrade --apply`. It rewrites the imports and the env feature mount, and reports `typeof fileProviderS3EnvFeature` and re-exports of it with file and line.",
+    "codemod": "scripts/codemod/s3-imports.ts"
+  }
+]

package/src/mail-transport-smtp/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.369.0",
+    "type": "breaking",
+    "title": "Tenant admins edit their own SMTP server on the Email sending screen",
+    "detail": "mail-foundation's provider key and the SMTP keys (host, port, SSL/TLS, user name, sender address) carry settings masks, so the generated Settings-Hub shows tenant admins one Email sending form: the provider choice, the chosen provider's connection fields and its password, each field with a help text and every label in English, German and Spanish, saved together by one Save button in one /api/batch. Switching the provider swaps the fields at once; fields of a provider that is not selected are not saved. A selector owner's selection screen (`<owner>-tenant-selection`) now carries the plugins' config keys (field id `<owner>-<key>`) and secrets (field id `<plugin>-<key>`, listed in the new ConfigEditScreenDefinition.secretKeys) behind a visible condition on the provider field; the separate `<plugin>-tenant` and `<plugin>-tenant-secrets` screens and their dashboard panels are gone, and so is the `config.settings.saveProvider` label. A secret with its own writeRoles stays on the global secrets screen. Boot validation checks every secretKeys field (tenant scope, writeOnly text, declared secret). The configEdit renderer loads secretKeys fields from secrets:query:list (set or unset, no preview), writes them with secrets:write:set or secrets:write:delete in the same batch, and leaves hidden fields out. The provider key is no longer required: empty means the tenant has no own server and the platform sends, so readiness no longer reports it as missing (createTransportForTenant still throws on an empty provider). The provider and SMTP keys are written by TenantAdmin and the system identity, no longer by SystemAdmin, because a platform-level provider would reach every tenant without that tenant's password. The secrets set and delete handlers also admit the system identity, so server code stores a tenant secret via dispatchSystemWrite through the same key and value checks as an admin; the settings screens keep showing only the human roles. The provider choice shows each plugin's `<feature>.settings` name, also for a plugin without settings of its own, and keeps the English name when a locale feature mounted earlier declares the same key in its own language only. A MailTransportPlugin with `selectableInSettings: false` stays allowed on the server but is not offered in the form; the in-memory transport sets it, because apps mount it next to smtp in production and a tenant admin picking it would drop every mail. A plugin's secrets section takes an optional `<feature>.settings.secrets` title (SMTP password under \"SMTP sign-in\").",
+    "migration": "E2E specs that used the testIds `dashboard-panel-<plugin>-tenant`, `dashboard-panel-<plugin>-tenant-secrets` or the separate secret input of these screens address the fields of `<owner>-tenant-selection` instead (one Save). Code that wrote these keys as a SystemAdmin user writes them as the tenant's TenantAdmin or via dispatchSystemWrite. Apps that relied on readiness flagging an empty provider check it themselves."
+  },
   {
     "version": "0.326.1",
     "type": "fix",

package/src/personal-access-tokens/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.368.0",
+    "type": "improvement",
+    "title": "The token list screen takes a description and slots via listScreen",
+    "detail": "createPersonalAccessTokensFeature({ listScreen: { description, slots } }) sets the i18n description and the slots (for example a header component) of the api-tokens list, so an app can show instructions above the list and use the bundled screen directly instead of embedding it in its own dashboard. Without the option nothing changes. Both bundled token screens are now marked agent: { expose: false }, since the mint screen reveals the token plaintext."
+  },
   {
     "version": "0.365.0",
     "type": "fix",

package/src/secrets/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.369.0",
+    "type": "fix",
+    "title": "secrets:write:set and secrets:write:delete join the request transaction",
+    "detail": "Both handlers ran on the boot database connection, so in an /api/batch a later failing command rolled back the config writes but kept the stored secret. They now run on the request transaction (escape hatch unsafeRaw, reason documented on the handler), so a batch of config and secret writes is stored as a whole or not at all."
+  },
   {
     "version": "0.365.0",
     "type": "fix",

package/src/user/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.368.0",
+    "type": "fix",
+    "title": "Soft-deleted users no longer count as active principals",
+    "detail": "A user deleted through the entity executor keeps its last status (usually active) with isDeleted set. principalStatusPlugin, the session checker and the PAT role resolver only looked at the status, so existing sessions and tokens of such a user stayed valid. They now treat isDeleted as blocked (session \"blocked\", PAT 401, principal_blocked for membership resolution) through the new isPrincipalRowBlocked predicate."
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/src/user-data-rights/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.369.0",
+    "type": "fix",
+    "title": "The \"account deleted\" mail is sent through channel-email when delivery is mounted",
+    "detail": "The default mailer for the Art. 17 deletion confirmation called createTransportForTenant directly, which threw for a tenant without its own mail provider. With delivery and channel-email mounted it now sends through the email channel like the other GDPR mails, over the app transport, without writing a delivery-attempt row for the already erased user. Without channel-email the previous path stays."
+  },
   {
     "version": "0.367.0",
     "type": "fix",

package/dist/file-provider-s3-env/feature.d.ts

@@ -1,3 +0,0 @@
-export declare const fileProviderS3EnvFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
-    readonly exports: void;
-};