@cosmicdrift/kumiko-bundled-features 0.367.0 → 0.369.0

package/dist/delivery/feature.js

@@ -1,4 +1,4 @@
-import { updateMany, upsertByPk } from "@cosmicdrift/kumiko-framework/bun-db";
+import { updateMany, upsertByPk } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineFeature, i18nKey, } from "@cosmicdrift/kumiko-framework/engine";
 import { ConsumerLagError } from "@cosmicdrift/kumiko-framework/pipeline";
 import { resolveAttemptLogRetentionDays, runAttemptLogRetention } from "./attempt-log-retention.js";
@@ -19,7 +19,7 @@ export function createDeliveryFeature(options) {
     const resolvedAccess = options?.access ?? access.admin;
     const attemptLogRetentionDays = resolveAttemptLogRetentionDays(options?.attemptLogRetentionDays);
     return defineFeature("delivery", (r) => {
-        r.describe("The notification dispatch core: call `ctx.notify(notificationType, { to, route, data, priority, idempotencyKey })` from any handler to fan out a notification across all registered channels (email, in-app, push). Inside a write handler the delivery runs after the write has committed (the call returns `{ kind: \"deferred\" }`, a rolled-back write sends nothing); `immediate: true` delivers synchronously and returns `{ kind: \"dispatched\", deliveries }`. It stores per-user channel preferences in the `notification-preference` entity, opt-outs for no-account recipient addresses in `notification-address-opt-out` (keyed by a blind-index hash, never the plaintext address), logs every attempt to `store_delivery_attempts`, and enforces idempotency and rate-limiting \u2014 add `channel-email`, `channel-in-app`, or `channel-push` on top to actually send anything. Unsubscribe/resubscribe links are served by `createUnsubscribeRoutes({ secret })` mounted via the app's `extraRoutes` at `/api/delivery/unsubscribe` and `/api/delivery/resubscribe`: `GET /unsubscribe?token=` renders a confirmation page (no write), `POST /unsubscribe` performs the opt-out (RFC 8058 one-click, token from the form body or query), `POST /resubscribe` undoes it (JSON `{token}` or form body only, never the query — reachable by a mail-client link prefetcher) — sign links with `signUnsubscribeToken` / `signAddressUnsubscribeToken` using the same secret. `channel-email` sets `List-Unsubscribe` / `List-Unsubscribe-Post` automatically when a message's `data.unsubscribeUrl` points at the unsubscribe route. A notification declared with `unsubscribe: true` gets that link from delivery itself when the service has `unsubscribeLinks` (`runProdApp` option `unsubscribe: { secret }` mounts the routes and wires it; base URL from `auth.publicOrigin`, `auth.mail.baseUrl` or `APP_BASE_URL`): user recipients get a user token, `route` recipients an address token (needs a blind-index key, otherwise no link); a `data.unsubscribeUrl` from the caller wins. `unsubscribe.tenantOrigin: (ctx) => origin | null` points the link at the tenant's own host (subdomain or custom domain, must serve this app's `/api`); null, a throw or a non-https value fall back to the app origin. The token carries the mail's locale, so the confirmation and result pages render in the mail's language. To react to a no-account opt-out (e.g. remove the app's own subscriber row), declare `r.job(name, { trigger: { on: DeliveryHandlers.unsubscribeAddress } }, handler)` on a lane the app consumes: it runs after each committed opt-out, also an idempotent repeat, with `unsubscribeAddressPayloadSchema` (`addressHash`, `notificationType`, `channel`) as payload and the tenant in `ctx.triggeredBy.tenantId`; match the subscriber via `hashUnsubscribeAddress(email)`. Declare `unsubscribeUrl` as an optional template variable if the mail body shows it.");
+        r.describe("The notification dispatch core: call `ctx.notify(notificationType, { to, route, data, priority, idempotencyKey })` from any handler to fan out a notification across all registered channels (email, in-app, push). Inside a write handler the delivery runs after the write has committed (the call returns `{ kind: \"deferred\" }`, a rolled-back write sends nothing); `immediate: true` delivers synchronously and returns `{ kind: \"dispatched\", deliveries }`. It stores per-user channel preferences in the `notification-preference` entity, opt-outs for no-account recipient addresses in `notification-address-opt-out` (keyed by a blind-index hash, never the plaintext address), logs every attempt to `store_delivery_attempts`, and enforces idempotency and rate-limiting \u2014 add `channel-email`, `channel-in-app`, or `channel-push` on top to actually send anything. Unsubscribe/resubscribe links are served by `createUnsubscribeRoutes({ secret })` mounted via the app's `extraRoutes` at `/api/delivery/unsubscribe` and `/api/delivery/resubscribe`: `GET /unsubscribe?token=` renders a confirmation page (no write), `POST /unsubscribe` performs the opt-out (RFC 8058 one-click, token from the form body or query), `POST /resubscribe` undoes it (JSON `{token}` or form body only, never the query — reachable by a mail-client link prefetcher) — sign links with `signUnsubscribeToken` / `signAddressUnsubscribeToken` using the same secret. `channel-email` sets `List-Unsubscribe` / `List-Unsubscribe-Post` automatically when a message's `data.unsubscribeUrl` points at the unsubscribe route. A notification declared with `unsubscribe: true` gets that link from delivery itself when the service has `unsubscribeLinks` (the `runProdApp` and `runDevApp` option `unsubscribe: { secret }` mounts the routes and wires it; base URL from `auth.publicOrigin`, `auth.mail.baseUrl` or `APP_BASE_URL`): user recipients get a user token, `route` recipients an address token (needs a blind-index key, otherwise no link); a `data.unsubscribeUrl` from the caller wins. `unsubscribe.tenantOrigin: (ctx) => origin | null` points the link at the tenant's own host (subdomain or custom domain, must serve this app's `/api`); null, a throw or a non-https value fall back to the app origin. The token carries the mail's locale, so the confirmation and result pages render in the mail's language. An app serving its own (e.g. legacy) unsubscribe links renders the same result page with `renderUnsubscribeResultPage({ kind, locale })`. To react to a no-account opt-out (e.g. remove the app's own subscriber row), declare `r.job(name, { trigger: { on: DeliveryHandlers.unsubscribeAddress } }, handler)` on a lane the app consumes: it runs after each committed opt-out, also an idempotent repeat, with `unsubscribeAddressPayloadSchema` (`addressHash`, `notificationType`, `channel`) as payload and the tenant in `ctx.triggeredBy.tenantId`; match the subscriber via `hashUnsubscribeAddress(email)`. Declare `unsubscribeUrl` as an optional template variable if the mail body shows it.");
         r.uiHints({
             displayLabel: "Notifications \u00b7 Dispatch Core",
             category: "notifications",

package/dist/delivery/handlers/log.query.js

@@ -1,5 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { decodeKeysetCursor, encodeKeysetCursor, } from "@cosmicdrift/kumiko-framework/db";
+import { decodeKeysetCursor, encodeKeysetCursor, selectMany, } from "@cosmicdrift/kumiko-framework/db";
 import { access, definePagedQueryHandler, isDeliveryErrorCode, isUuid, MAX_LIST_LIMIT, SYSTEM_USER_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
@@ -30,7 +29,7 @@ function isDeliveryLogSortField(value) {
     return value in DELIVERY_LOG_SORT_COLUMNS;
 }
 // createdAt round-trips through Temporal.Instant (matches how the WHERE
-// builder coerces timestamptz values — see bun-db/query.ts prepareValue);
+// builder coerces timestamptz values — see db/query.ts prepareValue);
 // every other whitelisted column is a plain text column. Keyed by the
 // PHYSICAL column, not the display alias — row only has the DB field names
 // (e.g. notificationType), never the alias (e.g. "type").

package/dist/delivery/handlers/preferences.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/dist/delivery/index.d.ts

@@ -2,7 +2,7 @@ export { sanitizePdfAttachmentFileName } from "../shared/index.js";
 export { hashUnsubscribeAddress } from "./address-opt-out.js";
 export { DELIVERY_ENVELOPE_DATA_KEYS, type EmailAttachmentRef, emailAttachmentRefSchema, type FileAttachmentRef, fileAttachmentRefSchema, type InlineAttachmentRef, inlineAttachmentRefSchema, MAX_EMAIL_ATTACHMENTS, MAX_RENDERED_PDF_VARIABLES_BYTES, type RenderedPdfAttachmentRef, renderedPdfAttachmentRefSchema, toAttachmentRef, withoutDeliveryEnvelopeKeys, } from "./attachment-ref.js";
 export { type AttemptLogRetentionOptions, DEFAULT_ATTEMPT_LOG_RETENTION_DAYS, runAttemptLogRetention, } from "./attempt-log-retention.js";
-export { createEmailAttachmentReader, createTemplateMailRenderer } from "./channel-context.js";
+export { buildChannelContext, createEmailAttachmentReader, createTemplateMailRenderer, } from "./channel-context.js";
 export { type ChatWebhookChannelOptions, chatMessageText, createChatWebhookChannel, resolveChatWebhookTarget, toChannelResult, } from "./chat-webhook-channel.js";
 export { type ChatSendFailureCode, type ChatSendResult, type ChatWebhookRequest, type ChatWebhookResponse, type ChatWebhookTarget, chatConnectionNameSchema, chatWebhookUrlSchema, checkChatWebhookTarget, DEFAULT_CHAT_TIMEOUT_MS, postChatWebhook, truncateChars, } from "./chat-webhook-sender.js";
 export type { DeliveryStatusValue } from "./constants.js";
@@ -10,10 +10,11 @@ export { DELIVERY_ATTEMPT_ADDRESS_ERASED_EVENT, DELIVERY_CHANNEL_EXTENSION, DELI
 export { collectChannels, createDeliveryService, type DeliveryServiceOptions, type KillSwitchResolver, type RateLimitConfig, } from "./delivery-service.js";
 export { createDeliveryFeature, type DeliveryFeatureOptions } from "./feature.js";
 export { type UnsubscribeAddressPayload, unsubscribeAddressPayloadSchema, } from "./handlers/unsubscribe-address.write.js";
+export { currentNotificationType } from "./notification-type-aliases.js";
 export { createDeliveryNotifyFactory } from "./notify-factory.js";
 export { deliveryAttemptsTable, notificationAddressOptOutEntity, notificationAddressOptOutsTable, notificationPreferenceEntity, notificationPreferencesTable, } from "./tables.js";
 export { type CreateDeliveryTestContextOptions, createDeliveryTestContext } from "./testing.js";
 export { type AttachmentOrigin, type ChannelContext, type ChannelMessage, type ChannelResult, type DeliveryChannel, type DeliveryChannelMode, type DeliveryChannelPlugin, type DeliveryLogEntry, type DeliveryService, isDeliveryChannelPlugin, type RenderedMessage, } from "./types.js";
-export { type AddressUnsubscribeTokenPayload, createUnsubscribeRoutes, DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE, signAddressUnsubscribeToken, signUnsubscribeToken, type UnsubscribeRouteOptions, type UnsubscribeTokenPayload, } from "./unsubscribe.js";
+export { type AddressUnsubscribeTokenPayload, createUnsubscribeRoutes, DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE, renderUnsubscribeResultPage, signAddressUnsubscribeToken, signUnsubscribeToken, type UnsubscribeResultPage, type UnsubscribeRouteOptions, type UnsubscribeTokenPayload, } from "./unsubscribe.js";
 export type { UnsubscribeLinkConfig } from "./unsubscribe-link.js";
 export { UNSUBSCRIBE_PAGE_EN } from "./unsubscribe-page-strings.js";

package/dist/delivery/index.js

@@ -2,16 +2,17 @@ export { sanitizePdfAttachmentFileName } from "../shared/index.js";
 export { hashUnsubscribeAddress } from "./address-opt-out.js";
 export { DELIVERY_ENVELOPE_DATA_KEYS, emailAttachmentRefSchema, fileAttachmentRefSchema, inlineAttachmentRefSchema, MAX_EMAIL_ATTACHMENTS, MAX_RENDERED_PDF_VARIABLES_BYTES, renderedPdfAttachmentRefSchema, toAttachmentRef, withoutDeliveryEnvelopeKeys, } from "./attachment-ref.js";
 export { DEFAULT_ATTEMPT_LOG_RETENTION_DAYS, runAttemptLogRetention, } from "./attempt-log-retention.js";
-export { createEmailAttachmentReader, createTemplateMailRenderer } from "./channel-context.js";
+export { buildChannelContext, createEmailAttachmentReader, createTemplateMailRenderer, } from "./channel-context.js";
 export { chatMessageText, createChatWebhookChannel, resolveChatWebhookTarget, toChannelResult, } from "./chat-webhook-channel.js";
 export { chatConnectionNameSchema, chatWebhookUrlSchema, checkChatWebhookTarget, DEFAULT_CHAT_TIMEOUT_MS, postChatWebhook, truncateChars, } from "./chat-webhook-sender.js";
 export { DELIVERY_ATTEMPT_ADDRESS_ERASED_EVENT, DELIVERY_CHANNEL_EXTENSION, DELIVERY_FEATURE, DELIVERY_LOG_SCREEN_ID, DELIVERY_UNSUBSCRIBE_PATH, DeliveryErrors, DeliveryHandlers, DeliveryJobs, DeliveryQueries, DeliveryStatus, EMAIL_CHANNEL_NAME, } from "./constants.js";
 export { collectChannels, createDeliveryService, } from "./delivery-service.js";
 export { createDeliveryFeature } from "./feature.js";
 export { unsubscribeAddressPayloadSchema, } from "./handlers/unsubscribe-address.write.js";
+export { currentNotificationType } from "./notification-type-aliases.js";
 export { createDeliveryNotifyFactory } from "./notify-factory.js";
 export { deliveryAttemptsTable, notificationAddressOptOutEntity, notificationAddressOptOutsTable, notificationPreferenceEntity, notificationPreferencesTable, } from "./tables.js";
 export { createDeliveryTestContext } from "./testing.js";
 export { isDeliveryChannelPlugin, } from "./types.js";
-export { createUnsubscribeRoutes, DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE, signAddressUnsubscribeToken, signUnsubscribeToken, } from "./unsubscribe.js";
+export { createUnsubscribeRoutes, DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE, renderUnsubscribeResultPage, signAddressUnsubscribeToken, signUnsubscribeToken, } from "./unsubscribe.js";
 export { UNSUBSCRIBE_PAGE_EN } from "./unsubscribe-page-strings.js";

package/dist/delivery/unsubscribe.d.ts

@@ -34,4 +34,17 @@ export declare function signUnsubscribeToken(payload: UnsubscribeTokenPayload, s
  */
 export declare function signAddressUnsubscribeToken(payload: AddressUnsubscribeTokenPayload, secret: string): Promise<string>;
 export declare const DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE: "List-Unsubscribe=One-Click";
+export type UnsubscribeResultPage = {
+    readonly kind: "unsubscribed";
+    readonly resubscribeToken?: string;
+} | {
+    readonly kind: "resubscribed";
+} | {
+    readonly kind: "failed";
+};
+/** The plain result page the unsubscribe routes answer with, for apps serving their own
+ *  (e.g. legacy) unsubscribe links. Texts come from the mail translations of `locale`. */
+export declare function renderUnsubscribeResultPage(page: UnsubscribeResultPage & {
+    readonly locale?: string | undefined;
+}): string;
 export declare function createUnsubscribeRoutes(options: UnsubscribeRouteOptions): readonly ExtraRouteDefinition[];

package/dist/delivery/unsubscribe.js

@@ -272,23 +272,30 @@ function confirmationPage(token, locale) {
 <button type="submit">${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.confirmButton"))}</button>
 </form>`);
 }
-function unsubscribedPage(resubscribeToken, locale) {
-    const lang = pageLocale(locale);
-    return htmlPage(lang, mailT(lang, "mail.unsubscribe.doneTitle"), `<p>${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.doneMessage"))}</p>
+/** The plain result page the unsubscribe routes answer with, for apps serving their own
+ *  (e.g. legacy) unsubscribe links. Texts come from the mail translations of `locale`. */
+export function renderUnsubscribeResultPage(page) {
+    const lang = pageLocale(page.locale);
+    switch (page.kind) {
+        case "unsubscribed": {
+            const undoForm = page.resubscribeToken === undefined
+                ? ""
+                : `
 <form method="post" action="${DELIVERY_RESUBSCRIBE_PATH}">
-<input type="hidden" name="token" value="${escapeHtmlAttr(resubscribeToken)}">
+<input type="hidden" name="token" value="${escapeHtmlAttr(page.resubscribeToken)}">
 <button type="submit">${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.undoButton"))}</button>
-</form>`);
-}
-function resubscribedPage(locale) {
-    const lang = pageLocale(locale);
-    return htmlPage(lang, mailT(lang, "mail.unsubscribe.resubscribedTitle"), `<p>${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.resubscribedMessage"))}</p>`);
-}
-function failedPage(locale) {
-    const lang = pageLocale(locale);
-    const message = mailT(lang, "mail.unsubscribe.failed");
-    return htmlPage(lang, message, `<p>${escapeHtmlAttr(message)}</p>`);
+</form>`;
+            return htmlPage(lang, mailT(lang, "mail.unsubscribe.doneTitle"), `<p>${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.doneMessage"))}</p>${undoForm}`);
+        }
+        case "resubscribed":
+            return htmlPage(lang, mailT(lang, "mail.unsubscribe.resubscribedTitle"), `<p>${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.resubscribedMessage"))}</p>`);
+        case "failed": {
+            const message = mailT(lang, "mail.unsubscribe.failed");
+            return htmlPage(lang, message, `<p>${escapeHtmlAttr(message)}</p>`);
+        }
+    }
 }
+const NO_STORE_HEADERS = { "Cache-Control": "no-store" };
 function isFormRequest(contentType) {
     return contentType?.includes("application/x-www-form-urlencoded") === true;
 }
@@ -350,9 +357,13 @@ export function createUnsubscribeRoutes(options) {
             // (e.g. events-table missing, DB down) behind a misleading 400.
             const succeeded = await dispatchUnsubscribeWrite(verified, deps);
             if (!succeeded) {
-                return c.html(failedPage(verified.locale), 500, { "Cache-Control": "no-store" });
+                return c.html(renderUnsubscribeResultPage({ kind: "failed", locale: verified.locale }), 500, NO_STORE_HEADERS);
             }
-            return c.html(unsubscribedPage(await signResubscribeToken(verified, encodedSecret), verified.locale), 200, { "Cache-Control": "no-store" });
+            return c.html(renderUnsubscribeResultPage({
+                kind: "unsubscribed",
+                resubscribeToken: await signResubscribeToken(verified, encodedSecret),
+                locale: verified.locale,
+            }), 200, NO_STORE_HEADERS);
         },
     });
     // Undo direction: token only from the JSON/form body, never the query
@@ -368,22 +379,16 @@ export function createUnsubscribeRoutes(options) {
             // The undo button on the unsubscribed page posts a form; a browser should land on a page.
             if (isFormRequest(c.req.header("content-type"))) {
                 return outcome === "success"
-                    ? c.html(resubscribedPage(verified.locale), 200, { "Cache-Control": "no-store" })
-                    : c.html(failedPage(verified.locale), outcome === "limit_reached" ? 409 : 500, {
-                        "Cache-Control": "no-store",
-                    });
+                    ? c.html(renderUnsubscribeResultPage({ kind: "resubscribed", locale: verified.locale }), 200, NO_STORE_HEADERS)
+                    : c.html(renderUnsubscribeResultPage({ kind: "failed", locale: verified.locale }), outcome === "limit_reached" ? 409 : 500, NO_STORE_HEADERS);
             }
             if (outcome === "limit_reached") {
-                return c.json({ error: { code: DeliveryErrors.resubscribeLimitReached } }, 409, {
-                    "Cache-Control": "no-store",
-                });
+                return c.json({ error: { code: DeliveryErrors.resubscribeLimitReached } }, 409, NO_STORE_HEADERS);
             }
             if (outcome === "failed") {
-                return c.json({ error: { code: "resubscribe_failed" } }, 500, {
-                    "Cache-Control": "no-store",
-                });
+                return c.json({ error: { code: "resubscribe_failed" } }, 500, NO_STORE_HEADERS);
             }
-            return c.json({ isSuccess: true }, 200, { "Cache-Control": "no-store" });
+            return c.json({ isSuccess: true }, 200, NO_STORE_HEADERS);
         },
     });
     return [confirmRoute, writeRoute, resubscribeRoute];

package/dist/delivery/upsert-preference.js

@@ -12,8 +12,7 @@
 // loser's create() comes back as a `version_conflict` failure; re-lookup and
 // fall through to update, or no-op if the winner already set the target
 // `enabled` state.
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, fetchOne, } from "@cosmicdrift/kumiko-framework/db";
 import { generateDeterministicId } from "@cosmicdrift/kumiko-framework/utils";
 import { notificationPreferenceEntity, notificationPreferencesTable } from "./tables.js";
 const executor = createEventStoreExecutor(notificationPreferencesTable, notificationPreferenceEntity, { entityName: "notification-preference" });

package/dist/derivatives-sharp/feature.d.ts

@@ -1,3 +1,7 @@
+export declare function createDerivativesSharpFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: void;
+};
+/** @deprecated Use createDerivativesSharpFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const derivativesSharpFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };

package/dist/derivatives-sharp/feature.js

@@ -2,14 +2,18 @@
 import { defineFeature, EXT_DERIVATIVE_RENDERER } from "@cosmicdrift/kumiko-framework/engine";
 import { renderImage } from "./render.js";
 const FEATURE_NAME = "derivatives-sharp";
-export const derivativesSharpFeature = defineFeature(FEATURE_NAME, (r) => {
-    r.describe("Registers an `image/*` renderer against the `derivativeRenderer` extension point declared by `file-derivatives`, backed by sharp. Supports resize/fit (cover, inside, contain), format conversion with quality (webp, avif, jpeg), whole-image blur, and blurring individual regions burned in before resize (see BlurRegion). EXIF orientation is applied and then normalized away, and all other EXIF (including GPS) is dropped. Server-only: sharp is a native binding — never import this from client code.");
-    r.uiHints({
-        displayLabel: "File Derivatives · Sharp",
-        category: "storage",
-        recommended: false,
-    });
-    r.requires({ features: ["file-derivatives"] });
-    const plugin = { render: renderImage };
-    r.useExtension(EXT_DERIVATIVE_RENDERER, "image/*", plugin);
-});
+export function createDerivativesSharpFeature() {
+    return defineFeature(FEATURE_NAME, (r) => {
+        r.describe("Registers an `image/*` renderer against the `derivativeRenderer` extension point declared by `file-derivatives`, backed by sharp. Supports resize/fit (cover, inside, contain), format conversion with quality (webp, avif, jpeg), whole-image blur, and blurring individual regions burned in before resize (see BlurRegion). EXIF orientation is applied and then normalized away, and all other EXIF (including GPS) is dropped. Server-only: sharp is a native binding — never import this from client code.");
+        r.uiHints({
+            displayLabel: "File Derivatives · Sharp",
+            category: "storage",
+            recommended: false,
+        });
+        r.requires({ features: ["file-derivatives"] });
+        const plugin = { render: renderImage };
+        r.useExtension(EXT_DERIVATIVE_RENDERER, "image/*", plugin);
+    }, { dedupeOptions: {} });
+}
+/** @deprecated Use createDerivativesSharpFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const derivativesSharpFeature = createDerivativesSharpFeature();

package/dist/derivatives-sharp/index.d.ts

@@ -1,2 +1,2 @@
-export { derivativesSharpFeature } from "./feature.js";
+export { createDerivativesSharpFeature, derivativesSharpFeature } from "./feature.js";
 export { imageMetadata } from "./render.js";

package/dist/derivatives-sharp/index.js

@@ -1,2 +1,2 @@
-export { derivativesSharpFeature } from "./feature.js";
+export { createDerivativesSharpFeature, derivativesSharpFeature } from "./feature.js";
 export { imageMetadata } from "./render.js";

package/dist/document-ingest-foundation/feature.d.ts

@@ -1,3 +1,10 @@
+export declare function createDocumentIngestFoundationFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: {
+        ocrLanguageConfigKey: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"text">;
+        maxPagesPerFileConfigKey: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"number">;
+    };
+};
+/** @deprecated Use createDocumentIngestFoundationFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const documentIngestFoundationFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: {
         ocrLanguageConfigKey: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"text">;

package/dist/document-ingest-foundation/feature.js

@@ -81,95 +81,99 @@ async function requestIngestForFileRef(event, fileRef, ctx) {
         },
     });
 }
-export const documentIngestFoundationFeature = defineFeature(FEATURE_NAME, (r) => {
-    r.describe("Shared PDF/Scan/Image → normalized-text ingest primitive. Owns the `documentExtract` entity (fileRefId, storageKey, per-page text + metadata) as an implicit entity-projection, the per-tenant `ocrLanguage`/`maxPagesPerFile` config keys, the `documentIngestProvider` extension-point providers register accepted mimeTypes/size caps under, and a fileRef.created/fileRef.restored trigger that resolves the provider for a file's mimeType and requests ingest via `documentIngest.requested` tagged with the winning provider — a delete→restore round-trip re-requests ingest the same way a fresh upload does. An orphan-extract guard forgets any `documentExtract` whose fileRef is no longer live at processing time, regardless of how a provider's own write races the fileRef's delete/forget — providers should write through `writeDocumentExtractForLiveFileRef`.");
-    r.uiHints({
-        displayLabel: "Document Ingest Foundation",
-        category: "storage",
-        recommended: false,
-    });
-    // tenant-lifecycle hosts EXT_TENANT_DATA — documentExtract.pages is
-    // tenant-subject ciphertext and needs the destroy hook below.
-    r.requires({ features: ["config", "tenant-lifecycle"] });
-    r.entity({ name: "documentExtract", ...documentExtractEntity });
-    r.useExtension(EXT_TENANT_DATA, "documentExtract", {
-        destroy: documentExtractTenantDestroyHook,
-    });
-    // No onRegister: resolution happens at boot and per-apply, not on register.
-    r.extendsRegistrar(EXT_DOCUMENT_INGEST_PROVIDER, {});
-    r.bootCheck(({ features }) => validateDocumentIngestProviderWiring(features));
-    const ocrLanguageConfigKey = r.config("ocrLanguage", createTenantConfig("text", {
-        default: "deu+eng",
-        // Tesseract -l argument syntax: one or more 3-letter language codes
-        // joined by "+" (e.g. "deu+eng"). Unconstrained free text here would
-        // reach the OCR provider call unvalidated (#1501).
-        pattern: { regex: "^[a-z]{3}(\\+[a-z]{3})*$" },
-        write: access.roles("TenantAdmin", "SystemAdmin"),
-        read: access.roles("TenantAdmin", "SystemAdmin", "User"),
-    }));
-    const maxPagesPerFileConfigKey = r.config("maxPagesPerFile", createTenantConfig("number", {
-        default: 50,
-        // Without a bound a tenant could set 0 (silently kills ingest) or an
-        // unbounded value (OCR worker runs per-file for as long as the PDF
-        // has pages — job-queue starvation) (#1501).
-        bounds: { min: 1, max: 500 },
-        write: access.roles("TenantAdmin", "SystemAdmin"),
-        read: access.roles("TenantAdmin", "SystemAdmin", "User"),
-    }));
-    // "fileName" can carry a real person's name, but it reaches both events already as the
-    // fileRef's own self-subject ciphertext (copied from fileRef.created/restored), which
-    // append() passes through; shredding the fileRef's key shreds it here too.
-    r.defineEvent(DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, documentIngestRequestedPayloadSchema, {
-        piiFields: "none",
-        version: 2,
-        migrations: [
-            {
-                fromVersion: 1,
-                toVersion: 2,
-                // The sentinel can never match a real where.provider filter (providers
-                // may not register under it) — an upcast v1 row reads as unclaimed
-                // instead of silently misrouting to a currently mounted provider.
-                transform: { default: { provider: UNCLAIMED_PROVIDER_SENTINEL } },
-            },
-        ],
-    });
-    r.defineEvent(DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, documentIngestSkippedPayloadSchema, {
-        piiFields: "none",
-    });
-    r.multiStreamProjection({
-        name: "request-ingest",
-        apply: {
-            [FILE_REF_CREATED]: async (event, _tx, ctx) => {
-                // entity-event payloads are generic Record<string, unknown> — parse
-                // at the MSP boundary (same pattern as storage-tracking's readNumber).
-                const parsed = fileRefIngestFieldsSchema.safeParse(event.payload);
-                // skip: malformed / incomplete payload — don't poison the consumer
-                if (!parsed.success)
-                    return;
-                await requestIngestForFileRef(event, parsed.data, ctx);
+export function createDocumentIngestFoundationFeature() {
+    return defineFeature(FEATURE_NAME, (r) => {
+        r.describe("Shared PDF/Scan/Image → normalized-text ingest primitive. Owns the `documentExtract` entity (fileRefId, storageKey, per-page text + metadata) as an implicit entity-projection, the per-tenant `ocrLanguage`/`maxPagesPerFile` config keys, the `documentIngestProvider` extension-point providers register accepted mimeTypes/size caps under, and a fileRef.created/fileRef.restored trigger that resolves the provider for a file's mimeType and requests ingest via `documentIngest.requested` tagged with the winning provider — a delete→restore round-trip re-requests ingest the same way a fresh upload does. An orphan-extract guard forgets any `documentExtract` whose fileRef is no longer live at processing time, regardless of how a provider's own write races the fileRef's delete/forget — providers should write through `writeDocumentExtractForLiveFileRef`.");
+        r.uiHints({
+            displayLabel: "Document Ingest Foundation",
+            category: "storage",
+            recommended: false,
+        });
+        // tenant-lifecycle hosts EXT_TENANT_DATA — documentExtract.pages is
+        // tenant-subject ciphertext and needs the destroy hook below.
+        r.requires({ features: ["config", "tenant-lifecycle"] });
+        r.entity({ name: "documentExtract", ...documentExtractEntity });
+        r.useExtension(EXT_TENANT_DATA, "documentExtract", {
+            destroy: documentExtractTenantDestroyHook,
+        });
+        // No onRegister: resolution happens at boot and per-apply, not on register.
+        r.extendsRegistrar(EXT_DOCUMENT_INGEST_PROVIDER, {});
+        r.bootCheck(({ features }) => validateDocumentIngestProviderWiring(features));
+        const ocrLanguageConfigKey = r.config("ocrLanguage", createTenantConfig("text", {
+            default: "deu+eng",
+            // Tesseract -l argument syntax: one or more 3-letter language codes
+            // joined by "+" (e.g. "deu+eng"). Unconstrained free text here would
+            // reach the OCR provider call unvalidated (#1501).
+            pattern: { regex: "^[a-z]{3}(\\+[a-z]{3})*$" },
+            write: access.roles("TenantAdmin", "SystemAdmin"),
+            read: access.roles("TenantAdmin", "SystemAdmin", "User"),
+        }));
+        const maxPagesPerFileConfigKey = r.config("maxPagesPerFile", createTenantConfig("number", {
+            default: 50,
+            // Without a bound a tenant could set 0 (silently kills ingest) or an
+            // unbounded value (OCR worker runs per-file for as long as the PDF
+            // has pages — job-queue starvation) (#1501).
+            bounds: { min: 1, max: 500 },
+            write: access.roles("TenantAdmin", "SystemAdmin"),
+            read: access.roles("TenantAdmin", "SystemAdmin", "User"),
+        }));
+        // "fileName" can carry a real person's name, but it reaches both events already as the
+        // fileRef's own self-subject ciphertext (copied from fileRef.created/restored), which
+        // append() passes through; shredding the fileRef's key shreds it here too.
+        r.defineEvent(DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, documentIngestRequestedPayloadSchema, {
+            piiFields: "none",
+            version: 2,
+            migrations: [
+                {
+                    fromVersion: 1,
+                    toVersion: 2,
+                    // The sentinel can never match a real where.provider filter (providers
+                    // may not register under it) — an upcast v1 row reads as unclaimed
+                    // instead of silently misrouting to a currently mounted provider.
+                    transform: { default: { provider: UNCLAIMED_PROVIDER_SENTINEL } },
+                },
+            ],
+        });
+        r.defineEvent(DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, documentIngestSkippedPayloadSchema, {
+            piiFields: "none",
+        });
+        r.multiStreamProjection({
+            name: "request-ingest",
+            apply: {
+                [FILE_REF_CREATED]: async (event, _tx, ctx) => {
+                    // entity-event payloads are generic Record<string, unknown> — parse
+                    // at the MSP boundary (same pattern as storage-tracking's readNumber).
+                    const parsed = fileRefIngestFieldsSchema.safeParse(event.payload);
+                    // skip: malformed / incomplete payload — don't poison the consumer
+                    if (!parsed.success)
+                        return;
+                    await requestIngestForFileRef(event, parsed.data, ctx);
+                },
+                [FILE_REF_RESTORED]: async (event, _tx, ctx) => {
+                    // fileRef.restored carries { previous }, the pre-restore soft-deleted
+                    // row (event-store-executor-write.ts restore()) — same field shape
+                    // as fileRef.created's payload.
+                    const parsed = fileRefIngestFieldsSchema.safeParse(event.payload["previous"]);
+                    // skip: malformed / incomplete previous snapshot — don't poison the consumer
+                    if (!parsed.success)
+                        return;
+                    await requestIngestForFileRef(event, parsed.data, ctx);
+                },
             },
-            [FILE_REF_RESTORED]: async (event, _tx, ctx) => {
-                // fileRef.restored carries { previous }, the pre-restore soft-deleted
-                // row (event-store-executor-write.ts restore()) — same field shape
-                // as fileRef.created's payload.
-                const parsed = fileRefIngestFieldsSchema.safeParse(event.payload["previous"]);
-                // skip: malformed / incomplete previous snapshot — don't poison the consumer
-                if (!parsed.success)
-                    return;
-                await requestIngestForFileRef(event, parsed.data, ctx);
+        });
+        // fileRef delete/forget cleanup: documentExtract rows are derived data —
+        // once the source file is gone (soft-deleted or Art.17-forgotten), the
+        // extracted text has no reason to survive it either.
+        r.multiStreamProjection({
+            name: "forget-extract-with-file-ref",
+            apply: {
+                [FILE_REF_DELETED]: forgetExtractOnFileRefDeletedHook,
+                [FILE_REF_FORGOTTEN]: forgetExtractOnFileRefForgottenHook,
+                [DOCUMENT_EXTRACT_CREATED]: forgetOrphanedDocumentExtractHook,
             },
-        },
-    });
-    // fileRef delete/forget cleanup: documentExtract rows are derived data —
-    // once the source file is gone (soft-deleted or Art.17-forgotten), the
-    // extracted text has no reason to survive it either.
-    r.multiStreamProjection({
-        name: "forget-extract-with-file-ref",
-        apply: {
-            [FILE_REF_DELETED]: forgetExtractOnFileRefDeletedHook,
-            [FILE_REF_FORGOTTEN]: forgetExtractOnFileRefForgottenHook,
-            [DOCUMENT_EXTRACT_CREATED]: forgetOrphanedDocumentExtractHook,
-        },
-    });
-    return { ocrLanguageConfigKey, maxPagesPerFileConfigKey };
-});
+        });
+        return { ocrLanguageConfigKey, maxPagesPerFileConfigKey };
+    }, { dedupeOptions: {} });
+}
+/** @deprecated Use createDocumentIngestFoundationFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const documentIngestFoundationFeature = createDocumentIngestFoundationFeature();

package/dist/document-ingest-foundation/forget-extract-with-file-ref.js

@@ -48,7 +48,7 @@ export const forgetOrphanedDocumentExtractHook = async (event, tx) => {
     // skip: malformed payload — don't poison the consumer
     if (!parsed.success)
         return;
-    const tenantDb = createTenantDb(tx, event.tenantId);
+    const tenantDb = createTenantDb({ db: tx, tenantId: event.tenantId });
     // skip: fileRef still live — the extract is legitimate
     if (await isFileRefLive(tenantDb, parsed.data.fileRefId))
         return;
@@ -60,7 +60,7 @@ export const forgetOrphanedDocumentExtractHook = async (event, tx) => {
     throw new Error(`document-ingest-foundation: failed to forget orphaned documentExtract ${event.aggregateId}: ${result.error.message}`);
 };
 export const forgetExtractOnFileRefDeletedHook = async (event, tx) => {
-    const tenantDb = createTenantDb(tx, event.tenantId);
+    const tenantDb = createTenantDb({ db: tx, tenantId: event.tenantId });
     // skip: fileRef is live again — request-ingest and this consumer poll via
     // separate cursors, so a delete→restore round-trip can finish before this
     // consumer sees fileRef.deleted; forgetting would drop the live file's extract.
@@ -69,6 +69,6 @@ export const forgetExtractOnFileRefDeletedHook = async (event, tx) => {
     await forgetExtractsForFileRef(event, tenantDb);
 };
 export const forgetExtractOnFileRefForgottenHook = async (event, tx) => {
-    const tenantDb = createTenantDb(tx, event.tenantId);
+    const tenantDb = createTenantDb({ db: tx, tenantId: event.tenantId });
     await forgetExtractsForFileRef(event, tenantDb);
 };

package/dist/document-ingest-foundation/index.d.ts

@@ -1,7 +1,7 @@
 export { documentIngestAggregateId } from "./aggregate-id.js";
 export { type DocumentExtractMeta, documentExtractEntity, documentExtractsTable, type IngestPage, } from "./entity.js";
 export { DOCUMENT_INGEST_AGGREGATE_TYPE, DOCUMENT_INGEST_REQUESTED_EVENT_QN, DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, DOCUMENT_INGEST_SKIPPED_EVENT_QN, DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, type DocumentIngestRequestedPayload, type DocumentIngestSkippedPayload, documentIngestRequestedPayloadSchema, documentIngestSkippedPayloadSchema, } from "./events.js";
-export { documentIngestFoundationFeature } from "./feature.js";
+export { createDocumentIngestFoundationFeature, documentIngestFoundationFeature, } from "./feature.js";
 export { readIngestPages, writeIngestPages } from "./pages.js";
 export { type DocumentIngestProviderOptions, documentIngestProviderOptionsSchema, documentIngestProviderTrigger, EXT_DOCUMENT_INGEST_PROVIDER, listIngestibleMimeTypes, type ResolvedDocumentIngestProvider, resolveDocumentIngestProviders, } from "./providers.js";
 export { type DocumentExtractWriteResult, writeDocumentExtractForLiveFileRef, } from "./write-document-extract.js";

package/dist/document-ingest-foundation/index.js

@@ -2,7 +2,7 @@
 export { documentIngestAggregateId } from "./aggregate-id.js";
 export { documentExtractEntity, documentExtractsTable, } from "./entity.js";
 export { DOCUMENT_INGEST_AGGREGATE_TYPE, DOCUMENT_INGEST_REQUESTED_EVENT_QN, DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, DOCUMENT_INGEST_SKIPPED_EVENT_QN, DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, documentIngestRequestedPayloadSchema, documentIngestSkippedPayloadSchema, } from "./events.js";
-export { documentIngestFoundationFeature } from "./feature.js";
+export { createDocumentIngestFoundationFeature, documentIngestFoundationFeature, } from "./feature.js";
 export { readIngestPages, writeIngestPages } from "./pages.js";
 export { documentIngestProviderOptionsSchema, documentIngestProviderTrigger, EXT_DOCUMENT_INGEST_PROVIDER, listIngestibleMimeTypes, resolveDocumentIngestProviders, } from "./providers.js";
 export { writeDocumentExtractForLiveFileRef, } from "./write-document-extract.js";

package/dist/feature-toggles/global-feature-state-table.js

@@ -1,5 +1,4 @@
-import { requireEntityTableMeta } from "@cosmicdrift/kumiko-framework/bun-db";
-import { boolean, declareGlobalTenancy, instant, integer, table as pgTable, sql, text, } from "@cosmicdrift/kumiko-framework/db";
+import { boolean, declareGlobalTenancy, instant, integer, table as pgTable, requireEntityTableMeta, sql, text, } from "@cosmicdrift/kumiko-framework/db";
 // Global feature-toggle override state. One row per feature that has ever
 // been explicitly flipped by an operator. Missing row = "no override,
 // fall back to the feature's r.toggleable({ default }) value".

package/dist/feature-toggles/handlers/set.write.js

@@ -1,4 +1,4 @@
-import { insertOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { insertOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, VersionConflictError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
@@ -109,10 +109,8 @@ export function createSetWriteHandler(getRuntime) {
             // and filtering by payload.featureName is trivial at query time.
             // This mirrors how `config` handles the same constraint for
             // its config-changed events.
-            // unsafeAppendEvent — bundled-features ohne lokalen Wrapper. Apps
-            // mit `bun kumiko codegen` kriegen `.kumiko/define.ts` als strict-
-            // path; bundled-features bleibt bei der unsafe-Variante. Schema-
-            // Validation läuft trotzdem via r.defineEvent("toggle-set", ...).
+            // unsafeAppendEvent: the strict appendEvent is bound to an app's own event map, which
+            // bundled-features cannot see. Schema validation still runs via r.defineEvent("toggle-set", ...).
             await ctx.unsafeAppendEvent({
                 aggregateId: SYSTEM_TENANT_ID,
                 aggregateType: FEATURE_TOGGLE_AGGREGATE_TYPE,

package/dist/feature-toggles/toggle-runtime.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { computeEffectiveFeatures, } from "@cosmicdrift/kumiko-framework/engine";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { createDefaultCacheSyncBus, } from "@cosmicdrift/kumiko-framework/redis";

package/dist/file-derivatives/feature.d.ts

@@ -25,4 +25,5 @@ export type FileDerivativesOptions = {
     readonly publicTenantResolution?: PublicVariantTenantResolution;
 };
 export declare function createFileDerivativesFeature(opts?: FileDerivativesOptions): FeatureDefinition;
+/** @deprecated Use createFileDerivativesFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const fileDerivativesFeature: FeatureDefinition;

package/dist/file-derivatives/feature.js

@@ -161,6 +161,7 @@ export function createFileDerivativesFeature(opts = {}) {
                 },
             });
         }
-    });
+    }, Object.keys(opts).length === 0 ? { dedupeOptions: {} } : undefined);
 }
+/** @deprecated Use createFileDerivativesFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export const fileDerivativesFeature = createFileDerivativesFeature();

package/dist/file-derivatives/handlers/public-variant-by-file-ref.query.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { createAnonymousUser, defineQueryHandler, isUuid, } from "@cosmicdrift/kumiko-framework/engine";
 import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import { isTenantServingPublicContent, tenantTable, } from "../../tenant/index.js";