@cosmicdrift/kumiko-bundled-features 0.367.0 → 0.369.0

package/dist/mail-transport-smtp/feature.d.ts

@@ -3,7 +3,7 @@ export declare const mailTransportSmtpEnvSchema: import("zod").ZodObject<{
     KUMIKO_MAIL_ALLOWED_PRIVATE_HOSTS: import("zod").ZodOptional<import("zod").ZodString>;
 }, import("zod/v4/core").$strip>;
 export declare function setSmtpMailHostLookup(fn: typeof lookup | undefined): void;
-export declare const mailTransportSmtpFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+export declare function createMailTransportSmtpFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: {
         /** Config-key-handles — typed reads via `ctx.config(...)` in
          *  consumer handlers. */
@@ -11,8 +11,24 @@ export declare const mailTransportSmtpFeature: import("@cosmicdrift/kumiko-types
             readonly host: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"text">;
             readonly port: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"number">;
             readonly secure: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"boolean">;
+            readonly authUser: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"text">;
             readonly from: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"text">;
+        };
+        /** Secret-handle for the SMTP password. */
+        password: import("@cosmicdrift/kumiko-types/feature").SecretKeyHandle;
+    };
+};
+/** @deprecated Use createMailTransportSmtpFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export declare const mailTransportSmtpFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: {
+        /** Config-key-handles — typed reads via `ctx.config(...)` in
+         *  consumer handlers. */
+        configKeys: {
+            readonly host: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"text">;
+            readonly port: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"number">;
+            readonly secure: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"boolean">;
             readonly authUser: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"text">;
+            readonly from: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"text">;
         };
         /** Secret-handle for the SMTP password. */
         password: import("@cosmicdrift/kumiko-types/feature").SecretKeyHandle;

package/dist/mail-transport-smtp/feature.js

@@ -28,9 +28,11 @@ import { createSmtpTransport, } from "@cosmicdrift/kumiko-bundled-features/chann
 import { BlockedHostError, HostResolutionError, mailAllowedPrivateHostsEnvSchema, readAllowedPrivateMailHostsFromEnv, requireDefined, requireNonEmpty, requireSecretSet, resolveMailConnectTarget, } from "@cosmicdrift/kumiko-bundled-features/foundation-shared";
 import { MAIL_TRANSPORT_EXTENSION, } from "@cosmicdrift/kumiko-bundled-features/mail-foundation";
 import { requireSecretsContext } from "@cosmicdrift/kumiko-bundled-features/secrets";
-import { access, createTenantConfig, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { UnconfiguredError } from "@cosmicdrift/kumiko-framework/errors";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
+import { SMTP_CONFIG_KEYS } from "./config-keys.js";
+import { MAIL_TRANSPORT_SMTP_I18N } from "./i18n.js";
 const FEATURE_NAME = "mail-transport-smtp";
 const log = createFallbackLogger(FEATURE_NAME);
 // Operator escape hatch for an internal relay or a dev/test SMTP server
@@ -50,82 +52,58 @@ export function setSmtpMailHostLookup(fn) {
 // =============================================================================
 // Feature-definition
 // =============================================================================
-export const mailTransportSmtpFeature = defineFeature(FEATURE_NAME, (r) => {
-    r.describe('Registers itself as the `"smtp"` provider for `mail-foundation` and owns the per-tenant config keys (`host`, `port`, `secure`, `from`, `authUser`) and the encrypted `smtp.password` secret. Tenants set `mail-foundation`\'s `provider` config key to `"smtp"` to activate it; set the SMTP credentials via the admin UI or a seed handler before sending the first mail.');
-    r.uiHints({
-        displayLabel: "Mail Transport · SMTP",
-        category: "notifications",
-        recommended: false,
-    });
-    r.requires({ features: ["config"] });
-    r.requires({ features: ["secrets"] });
-    r.requires({ features: ["mail-foundation"] });
-    r.envSchema(mailTransportSmtpEnvSchema);
-    // Provider-secret. Sensitive: redact-helper for admin-UI display.
-    const password = r.secret("smtp.password", {
-        label: { en: "SMTP password" },
-        hint: {
-            en: "Login password at the SMTP server. Brevo/Postmark/SES call it 'API key' or 'SMTP credentials'.",
-        },
-        redact: (plaintext) => {
-            if (plaintext.length < 8)
-                return "•".repeat(plaintext.length);
-            return `${plaintext.slice(0, 3)}...${plaintext.slice(-2)}`;
-        },
-        scope: "tenant",
-        // required: true ↔ the missing-secret throw in readPassword — keep in sync.
-        required: true,
-    });
-    // required: true ↔ the requireNonEmpty calls in buildSmtpTransport — keep in sync.
-    const configKeys = r.config({
-        keys: {
-            host: createTenantConfig("text", {
-                required: true,
-                default: "",
-                write: access.roles("TenantAdmin", "SystemAdmin"),
-                read: access.roles("TenantAdmin", "SystemAdmin"),
-            }),
-            port: createTenantConfig("number", {
-                default: 587,
-                bounds: { min: 1, max: 65535 },
-                write: access.roles("TenantAdmin", "SystemAdmin"),
-            }),
-            secure: createTenantConfig("boolean", {
-                default: false,
-                write: access.roles("TenantAdmin", "SystemAdmin"),
-            }),
-            from: createTenantConfig("text", {
-                required: true,
-                default: "",
-                write: access.roles("TenantAdmin", "SystemAdmin"),
-                read: access.roles("TenantAdmin", "SystemAdmin"),
-            }),
-            authUser: createTenantConfig("text", {
-                required: true,
-                default: "",
-                write: access.roles("TenantAdmin", "SystemAdmin"),
-                read: access.roles("TenantAdmin", "SystemAdmin"),
-            }),
-        },
-    });
-    // Plugin: register against mail-foundation's "mailTransport" extension.
-    // `entityName` "smtp" is what tenants set in mail-foundation's
-    // `provider` config-key to pick this transport.
-    const plugin = {
-        build: async (ctx, tenantId) => buildSmtpTransport(ctx, tenantId), // @wrapper-known semantic-alias
-    };
-    r.useExtension(MAIL_TRANSPORT_EXTENSION, "smtp", plugin);
-    return {
-        /** Config-key-handles — typed reads via `ctx.config(...)` in
-         *  consumer handlers. */
-        configKeys,
-        /** Secret-handle for the SMTP password. */
-        password,
-    };
-});
+export function createMailTransportSmtpFeature() {
+    return defineFeature(FEATURE_NAME, (r) => {
+        r.describe('Registers itself as the `"smtp"` provider for `mail-foundation` and owns the per-tenant config keys (`host`, `port`, `secure`, `from`, `authUser`) and the encrypted `smtp.password` secret. Tenants set `mail-foundation`\'s `provider` config key to `"smtp"` to activate it; set the SMTP credentials via the admin UI or a seed handler before sending the first mail.');
+        r.uiHints({
+            displayLabel: "Mail Transport · SMTP",
+            category: "notifications",
+            recommended: false,
+        });
+        r.requires({ features: ["config"] });
+        r.requires({ features: ["secrets"] });
+        r.requires({ features: ["mail-foundation"] });
+        r.envSchema(mailTransportSmtpEnvSchema);
+        // Provider-secret. Sensitive: redact-helper for admin-UI display.
+        const password = r.secret("smtp.password", {
+            label: { en: "SMTP password" },
+            hint: {
+                en: "Login password at the SMTP server. Brevo/Postmark/SES call it 'API key' or 'SMTP credentials'.",
+            },
+            redact: (plaintext) => {
+                if (plaintext.length < 8)
+                    return "•".repeat(plaintext.length);
+                return `${plaintext.slice(0, 3)}...${plaintext.slice(-2)}`;
+            },
+            scope: "tenant",
+            // required: true ↔ the missing-secret throw in readPassword — keep in sync.
+            required: true,
+        });
+        const configKeys = r.config({ keys: SMTP_CONFIG_KEYS });
+        r.translations({ keys: MAIL_TRANSPORT_SMTP_I18N });
+        // Plugin: register against mail-foundation's "mailTransport" extension.
+        // `entityName` "smtp" is what tenants set in mail-foundation's
+        // `provider` config-key to pick this transport.
+        const plugin = {
+            build: async (ctx, tenantId) => buildSmtpTransport(ctx, tenantId), // @wrapper-known semantic-alias
+        };
+        r.useExtension(MAIL_TRANSPORT_EXTENSION, "smtp", plugin);
+        return {
+            /** Config-key-handles — typed reads via `ctx.config(...)` in
+             *  consumer handlers. */
+            configKeys,
+            /** Secret-handle for the SMTP password. */
+            password,
+        };
+    }, { dedupeOptions: {} });
+}
+// The typed handles below come from one shared instance; each factory call builds its own handle objects.
+const sharedMailTransportSmtpFeature = createMailTransportSmtpFeature();
+/** @deprecated Use createMailTransportSmtpFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const mailTransportSmtpFeature = sharedMailTransportSmtpFeature;
 /** Typed handle for the SMTP password — exported so seeds + tests can
  *  set it via `secrets:write:set` with the full qualified-name. */
-export const SMTP_PASSWORD = mailTransportSmtpFeature.exports.password;
+export const SMTP_PASSWORD = sharedMailTransportSmtpFeature.exports.password;
 // =============================================================================
 // Internal: build the EmailTransport from tenant config + secret
 // =============================================================================
@@ -146,11 +124,11 @@ async function buildSmtpTransport(ctx, tenantId) {
         throw new Error(`${FEATURE_NAME}: ctx.config is missing — feature requires the config-feature mounted in the registry`);
     }
     const SMTP_HINT = "Set via tenant-admin UI or seed-handler before sending mail.";
-    const host = requireNonEmpty(await ctxConfig(mailTransportSmtpFeature.exports.configKeys.host), FEATURE_NAME, "host", SMTP_HINT);
-    const port = requireDefined(await ctxConfig(mailTransportSmtpFeature.exports.configKeys.port), FEATURE_NAME, "port"); // @cast-boundary engine-payload
-    const secure = requireDefined(await ctxConfig(mailTransportSmtpFeature.exports.configKeys.secure), FEATURE_NAME, "secure"); // @cast-boundary engine-payload
-    const from = requireNonEmpty(await ctxConfig(mailTransportSmtpFeature.exports.configKeys.from), FEATURE_NAME, "from", SMTP_HINT);
-    const authUser = requireNonEmpty(await ctxConfig(mailTransportSmtpFeature.exports.configKeys.authUser), FEATURE_NAME, "authUser", SMTP_HINT);
+    const host = requireNonEmpty(await ctxConfig(sharedMailTransportSmtpFeature.exports.configKeys.host), FEATURE_NAME, "host", SMTP_HINT);
+    const port = requireDefined(await ctxConfig(sharedMailTransportSmtpFeature.exports.configKeys.port), FEATURE_NAME, "port"); // @cast-boundary engine-payload
+    const secure = requireDefined(await ctxConfig(sharedMailTransportSmtpFeature.exports.configKeys.secure), FEATURE_NAME, "secure"); // @cast-boundary engine-payload
+    const from = requireNonEmpty(await ctxConfig(sharedMailTransportSmtpFeature.exports.configKeys.from), FEATURE_NAME, "from", SMTP_HINT);
+    const authUser = requireNonEmpty(await ctxConfig(sharedMailTransportSmtpFeature.exports.configKeys.authUser), FEATURE_NAME, "authUser", SMTP_HINT);
     const password = await readPassword(ctx, tenantId);
     let target;
     try {

package/dist/mail-transport-smtp/i18n.d.ts

@@ -0,0 +1,41 @@
+export declare const MAIL_TRANSPORT_SMTP_I18N: {
+    readonly "mail-transport-smtp.settings": {
+        readonly en: "SMTP server";
+    };
+    readonly "mail-transport-smtp.settings.secrets": {
+        readonly en: "SMTP sign-in";
+    };
+    readonly "mail-transport-smtp.settings.description": {
+        readonly en: "The connection details come from your mail provider, for example Brevo, Postmark, Amazon SES or your own server.";
+    };
+    readonly "mail-transport-smtp.host": {
+        readonly en: "Server address";
+    };
+    readonly "mail-transport-smtp.host.description": {
+        readonly en: "Host name of the SMTP server, for example smtp.example.com.";
+    };
+    readonly "mail-transport-smtp.port": {
+        readonly en: "Port number";
+    };
+    readonly "mail-transport-smtp.port.description": {
+        readonly en: "Usually 587. Use 465 when your provider asks for SSL/TLS.";
+    };
+    readonly "mail-transport-smtp.secure": {
+        readonly en: "SSL/TLS from the start";
+    };
+    readonly "mail-transport-smtp.secure.description": {
+        readonly en: "Turn on for port 465. Leave off for 587, which switches to encryption by itself.";
+    };
+    readonly "mail-transport-smtp.authUser": {
+        readonly en: "User name";
+    };
+    readonly "mail-transport-smtp.authUser.description": {
+        readonly en: "Login name at the SMTP server, often an email address.";
+    };
+    readonly "mail-transport-smtp.from": {
+        readonly en: "Sender address";
+    };
+    readonly "mail-transport-smtp.from.description": {
+        readonly en: "The address mails are sent from, for example status@example.com. Your provider must allow it.";
+    };
+};

package/dist/mail-transport-smtp/i18n.js

@@ -0,0 +1,28 @@
+export const MAIL_TRANSPORT_SMTP_I18N = {
+    // Also the option label of mail-foundation's provider select.
+    "mail-transport-smtp.settings": { en: "SMTP server" },
+    "mail-transport-smtp.settings.secrets": { en: "SMTP sign-in" },
+    "mail-transport-smtp.settings.description": {
+        en: "The connection details come from your mail provider, for example Brevo, Postmark, Amazon SES or your own server.",
+    },
+    "mail-transport-smtp.host": { en: "Server address" },
+    "mail-transport-smtp.host.description": {
+        en: "Host name of the SMTP server, for example smtp.example.com.",
+    },
+    "mail-transport-smtp.port": { en: "Port number" },
+    "mail-transport-smtp.port.description": {
+        en: "Usually 587. Use 465 when your provider asks for SSL/TLS.",
+    },
+    "mail-transport-smtp.secure": { en: "SSL/TLS from the start" },
+    "mail-transport-smtp.secure.description": {
+        en: "Turn on for port 465. Leave off for 587, which switches to encryption by itself.",
+    },
+    "mail-transport-smtp.authUser": { en: "User name" },
+    "mail-transport-smtp.authUser.description": {
+        en: "Login name at the SMTP server, often an email address.",
+    },
+    "mail-transport-smtp.from": { en: "Sender address" },
+    "mail-transport-smtp.from.description": {
+        en: "The address mails are sent from, for example status@example.com. Your provider must allow it.",
+    },
+};

package/dist/mail-transport-smtp/index.d.ts

@@ -1 +1 @@
-export { mailTransportSmtpEnvSchema, mailTransportSmtpFeature, SMTP_PASSWORD, setSmtpMailHostLookup, } from "./feature.js";
+export { createMailTransportSmtpFeature, mailTransportSmtpEnvSchema, mailTransportSmtpFeature, SMTP_PASSWORD, setSmtpMailHostLookup, } from "./feature.js";

package/dist/mail-transport-smtp/index.js

@@ -1,2 +1,2 @@
 // Public API of the mail-transport-smtp bundled-feature.
-export { mailTransportSmtpEnvSchema, mailTransportSmtpFeature, SMTP_PASSWORD, setSmtpMailHostLookup, } from "./feature.js";
+export { createMailTransportSmtpFeature, mailTransportSmtpEnvSchema, mailTransportSmtpFeature, SMTP_PASSWORD, setSmtpMailHostLookup, } from "./feature.js";

package/dist/managed-pages/handlers/by-slug.query.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { pagesTable } from "../table.js";

package/dist/managed-pages/handlers/by-tenant-published.query.js

@@ -1,5 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { castTenantRows } from "@cosmicdrift/kumiko-framework/db";
+import { castTenantRows, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { pagesTable } from "../table.js";

package/dist/managed-pages/handlers/set.write.js

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { requireForTenant } from "../../shared/index.js";

package/dist/managed-pages/seeding.js

@@ -1,10 +1,8 @@
 // Test-/Seed-Helper für managed-pages. Legt eine Page direkt über den
 // Event-Store-Executor an — gleicher Pfad wie der echte set-Handler, aber
 // ohne Access-Check. Default ifExists="skip".
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-framework/db";
-import { runEventStoreSeed } from "@cosmicdrift/kumiko-framework/seeding";
-import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
+import { createEventStoreExecutor, createTenantDb, fetchOne, } from "@cosmicdrift/kumiko-framework/db";
+import { runEventStoreSeed, TestUsers, } from "@cosmicdrift/kumiko-framework/seeding";
 import { pageEntity, pagesTable } from "./table.js";
 const executor = createEventStoreExecutor(pagesTable, pageEntity, { entityName: "page" });
 export async function seedPage(db, opts) {
@@ -12,7 +10,7 @@ export async function seedPage(db, opts) {
     // der event-store-stream im falschen tenant-bucket → version_conflict
     // bei späteren echten writes). TestUsers.systemAdmin ist testTenantId(1).
     const by = opts.by ?? { ...TestUsers.systemAdmin, tenantId: opts.tenantId };
-    const tdb = createTenantDb(db, opts.tenantId, "system");
+    const tdb = createTenantDb({ db, tenantId: opts.tenantId, mode: "system" });
     const existing = await fetchOne(db, pagesTable, {
         tenantId: opts.tenantId,
         slug: opts.slug,

package/dist/metrics/compute.d.ts

@@ -1,4 +1,4 @@
-import type { WhereObject } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { WhereObject } from "@cosmicdrift/kumiko-framework/db";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import type { TenantDb } from "@cosmicdrift/kumiko-types/tenant-db-types";
 import { type MetricRange } from "./constants.js";

package/dist/metrics/filters.d.ts

@@ -1,4 +1,4 @@
-import { type WhereObject } from "@cosmicdrift/kumiko-framework/bun-db";
+import { type WhereObject } from "@cosmicdrift/kumiko-framework/db";
 import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import type { MetricDefinition, MetricFilterResolver } from "./types.js";

package/dist/metrics/filters.js

@@ -1,4 +1,4 @@
-import { extractTableInfo } from "@cosmicdrift/kumiko-framework/bun-db";
+import { extractTableInfo } from "@cosmicdrift/kumiko-framework/db";
 import * as z from "zod";
 export const RESERVED_PAYLOAD_KEYS = ["range", "timeZone", "tenantId"];
 // Dashboard select options always send strings.

package/dist/metrics/validate.js

@@ -1,4 +1,4 @@
-import { extractTableInfo, isTimestamptzType } from "@cosmicdrift/kumiko-framework/bun-db";
+import { extractTableInfo, isTimestamptzType } from "@cosmicdrift/kumiko-framework/db";
 import { METRIC_RANGES } from "./constants.js";
 import { filterValueKindOf, metricFilterEntries, RESERVED_PAYLOAD_KEYS } from "./filters.js";
 const KEBAB_ID = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;

package/dist/notes-history/feature.d.ts

@@ -1,5 +1,5 @@
 import { type AccessRule, type EntityDefinition } from "@cosmicdrift/kumiko-framework/engine";
-export declare const notesHistoryFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+declare const defaultNotesHistoryFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };
 export type NotesHistoryFeatureOptions = {
@@ -38,4 +38,9 @@ export type NotesHistoryFeatureOptions = {
      *  consider every registered entity as a candidate host. */
     readonly parents?: readonly string[];
 };
-export declare function createNotesHistoryFeature(opts?: NotesHistoryFeatureOptions): typeof notesHistoryFeature;
+export declare function createNotesHistoryFeature(opts?: NotesHistoryFeatureOptions): typeof defaultNotesHistoryFeature;
+/** @deprecated Use createNotesHistoryFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export declare const notesHistoryFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: void;
+};
+export {};

package/dist/notes-history/feature.js

@@ -41,7 +41,7 @@ function registerNotesHistory(r, access, ownership, parents) {
     }));
     r.translations({ keys: NOTES_HISTORY_FEATURE_I18N });
 }
-export const notesHistoryFeature = defineFeature(NOTES_HISTORY_FEATURE_NAME, (r) => registerNotesHistory(r, DEFAULT_NOTES_HISTORY_ACCESS, undefined, undefined));
+const defaultNotesHistoryFeature = defineFeature(NOTES_HISTORY_FEATURE_NAME, (r) => registerNotesHistory(r, DEFAULT_NOTES_HISTORY_ACCESS, undefined, undefined));
 function resolveAccess(opts) {
     if (opts.access !== undefined)
         return opts.access;
@@ -56,7 +56,7 @@ export function createNotesHistoryFeature(opts = {}) {
         opts.roles === undefined &&
         opts.ownership === undefined &&
         opts.parents === undefined) {
-        return notesHistoryFeature;
+        return defaultNotesHistoryFeature;
     }
     assertNoWhereRuleInOwnershipWrite("createNotesHistoryFeature", opts.ownership?.write);
     // A mount that accepts no parents at all can never take a note write —
@@ -69,3 +69,5 @@ export function createNotesHistoryFeature(opts = {}) {
     }
     return defineFeature(NOTES_HISTORY_FEATURE_NAME, (r) => registerNotesHistory(r, resolveAccess(opts), opts.ownership, opts.parents));
 }
+/** @deprecated Use createNotesHistoryFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const notesHistoryFeature = createNotesHistoryFeature();

package/dist/notes-history/handlers/add-note.write.js

@@ -1,4 +1,4 @@
-import { fetchOne, runInSavepointIfSupported } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, runInSavepointIfSupported } from "@cosmicdrift/kumiko-framework/db";
 import { ValidationError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { decryptStoredPii, denyUnlessJoinRowParentVisible } from "../../shared/index.js";
 import { tenantMembershipsTable } from "../../tenant/index.js";

package/dist/notes-history-user-data/hooks.js

@@ -3,8 +3,8 @@
 // notes consumers without the user-data-rights pipeline don't pull a hard
 // dependency. Mirrors job-run/delivery-attempt (user-data-rights-defaults):
 // export-only, erasure via crypto-shredding.
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms } from "@cosmicdrift/kumiko-framework/crypto";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { noteEntryTable, noteMentionTable } from "../notes-history/index.js";
 // note-entry has no per-tenant scope quirk (unlike folders) — it's genuinely
 // per-user content, so the export filters by authorId directly.

package/dist/notes-history-user-data/index.d.ts

@@ -1,4 +1,8 @@
 export { eraseNoteBodiesReachingSubject } from "./hooks.js";
+export declare function createNotesHistoryUserDataFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: void;
+};
+/** @deprecated Use createNotesHistoryUserDataFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const notesHistoryUserDataFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };

package/dist/notes-history-user-data/index.js

@@ -7,20 +7,24 @@
 import { defineFeature, EXT_USER_DATA } from "@cosmicdrift/kumiko-framework/engine";
 import { noteEntryDeleteHook, noteEntryExportHook, noteMentionDeleteHook, noteMentionExportHook, } from "./hooks.js";
 export { eraseNoteBodiesReachingSubject } from "./hooks.js";
-export const notesHistoryUserDataFeature = defineFeature("notes-history-user-data", (r) => {
-    r.describe("GDPR (Art. 20 export / Art. 17 erasure) coverage for the `notes-history` feature's `note-entry` and `note-mention` entities. Mounts the export hook so a user's authored notes are included in the user-data export bundle; the note-entry delete hook crypto-shreds the row-subject key of each note that structurally @-mentions the forgotten user (`note-mention`) or hangs on the user as host entity (regardless of the host entity's retention strategy: the note text is free PII, the host's anonymize/blockDelete protects the row, not the content), keeping the append-only history intact for all other notes. The manual `crypto-shredding` forget-subject command reaches the same notes for user and record subjects through the exported `eraseNoteBodiesReachingSubject`, and the export lists them under `note-mention`. `note-mention`'s own hooks are a no-op — it is a plain FK pointer, not separately exportable content. Kept separate from `notes-history` so notes consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `notes-history`.");
-    // user-data-rights is the hard dependency (EXT_USER_DATA host). notes-history
-    // is OPTIONAL: if it's mounted toggleable(default=false), a hard r.requires
-    // would throw an "effectively disabled" boot warning even though the
-    // note-entry entity exists and the hooks work fine.
-    r.requires({ features: ["user-data-rights"] });
-    r.optionalRequires("notes-history");
-    r.useExtension(EXT_USER_DATA, "note-entry", {
-        export: noteEntryExportHook,
-        delete: noteEntryDeleteHook,
-    });
-    r.useExtension(EXT_USER_DATA, "note-mention", {
-        export: noteMentionExportHook,
-        delete: noteMentionDeleteHook,
-    });
-});
+export function createNotesHistoryUserDataFeature() {
+    return defineFeature("notes-history-user-data", (r) => {
+        r.describe("GDPR (Art. 20 export / Art. 17 erasure) coverage for the `notes-history` feature's `note-entry` and `note-mention` entities. Mounts the export hook so a user's authored notes are included in the user-data export bundle; the note-entry delete hook crypto-shreds the row-subject key of each note that structurally @-mentions the forgotten user (`note-mention`) or hangs on the user as host entity (regardless of the host entity's retention strategy: the note text is free PII, the host's anonymize/blockDelete protects the row, not the content), keeping the append-only history intact for all other notes. The manual `crypto-shredding` forget-subject command reaches the same notes for user and record subjects through the exported `eraseNoteBodiesReachingSubject`, and the export lists them under `note-mention`. `note-mention`'s own hooks are a no-op — it is a plain FK pointer, not separately exportable content. Kept separate from `notes-history` so notes consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `notes-history`.");
+        // user-data-rights is the hard dependency (EXT_USER_DATA host). notes-history
+        // is OPTIONAL: if it's mounted toggleable(default=false), a hard r.requires
+        // would throw an "effectively disabled" boot warning even though the
+        // note-entry entity exists and the hooks work fine.
+        r.requires({ features: ["user-data-rights"] });
+        r.optionalRequires("notes-history");
+        r.useExtension(EXT_USER_DATA, "note-entry", {
+            export: noteEntryExportHook,
+            delete: noteEntryDeleteHook,
+        });
+        r.useExtension(EXT_USER_DATA, "note-mention", {
+            export: noteMentionExportHook,
+            delete: noteMentionDeleteHook,
+        });
+    }, { dedupeOptions: {} });
+}
+/** @deprecated Use createNotesHistoryUserDataFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const notesHistoryUserDataFeature = createNotesHistoryUserDataFeature();

package/dist/personal-access-tokens/feature.d.ts

@@ -1,4 +1,4 @@
-import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type FeatureDefinition, type ProjectionListScreenDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { type PatRateLimit } from "./constants.js";
 import { type CreatePatOptions } from "./handlers/create.write.js";
 import type { PatScopeConfig } from "./scopes.js";
@@ -17,6 +17,9 @@ export type PersonalAccessTokensOptions = {
      *  shown in place of the token screens when the tenant's tier excludes the
      *  feature, e.g. an upgrade notice. Default: the standard "unavailable" notice. */
     readonly lockedFallbackScreen?: string;
+    /** Description (i18n key) and slots rendered on the token list screen, e.g. an
+     *  explanatory text or a header component above the list. Default: neither. */
+    readonly listScreen?: Pick<ProjectionListScreenDefinition, "description" | "slots">;
     readonly mfaVerifier?: CreatePatOptions["mfaVerifier"];
     readonly autoRevokeOnPasswordChange?: (userId: string) => Promise<number>;
 };

package/dist/personal-access-tokens/feature.js

@@ -1,7 +1,7 @@
 import { EXT_TOKEN_VERIFIER, } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { PAT_TOKEN_PREFIX } from "@cosmicdrift/kumiko-framework/api";
 import { deriveEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
-import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { defineFeature, } from "@cosmicdrift/kumiko-framework/engine";
 import { API_TOKEN_ENTITY_NAME, PAT_DEFAULT_RATE_LIMIT, PAT_FEATURE, } from "./constants.js";
 import { availabilityQuery } from "./handlers/availability.query.js";
 import { buildAvailableScopesQuery } from "./handlers/available-scopes.query.js";
@@ -116,7 +116,15 @@ export function createPersonalAccessTokensFeature(options) {
         // Declarative screens — list-with-revoke + mint-with-reveal. The app
         // places `patListScreen` via r.nav in its logged-in settings area.
         const lockedFallback = options.lockedFallbackScreen === undefined ? {} : { fallback: options.lockedFallbackScreen };
-        r.screen({ ...patListScreen, ...lockedFallback });
+        // Copy the two fields explicitly: a wider object passed as a variable
+        // escapes the Pick check and would override agent/access otherwise.
+        const { description, slots } = options.listScreen ?? {};
+        r.screen({
+            ...patListScreen,
+            ...(description === undefined ? {} : { description }),
+            ...(slots === undefined ? {} : { slots }),
+            ...lockedFallback,
+        });
         r.screen({ ...createPatMintScreen(scopes), ...lockedFallback });
         r.translations({ keys: { ...PAT_FEATURE_I18N, ...patScopeOptionTranslations(scopes) } });
         // rateLimit flows into feature.exports so run-prod-app builds the

package/dist/personal-access-tokens/handlers/create.write.js

@@ -1,4 +1,4 @@
-import { insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { insertOne } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";

package/dist/personal-access-tokens/handlers/list.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { definePagedQueryHandler, MAX_LIST_LIMIT } from "@cosmicdrift/kumiko-framework/engine";
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
@@ -7,7 +7,7 @@ import { isExpiredAt } from "../expiry.js";
 import { apiTokenTable } from "../schema/api-token.js";
 // `sort` arrives raw from the client's query string. selectMany's orderBy has
 // no column-existence check — an unrecognised field just gets snake_cased and
-// quoted as-is (bun-db/query.ts columnOf) — so this allowlist is what stops a
+// quoted as-is (db/query.ts columnOf) — so this allowlist is what stops a
 // client sorting by tokenHash or any other non-exposed column.
 const SORTABLE_COLUMNS = ["id", "name", "createdAt", "expiresAt", "revokedAt"];
 function isSortableColumn(value) {

package/dist/personal-access-tokens/handlers/revoke.write.js

@@ -1,4 +1,4 @@
-import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { updateMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";

package/dist/personal-access-tokens/resolver.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { isExpiredAt } from "./expiry.js";
 import { hashPatToken } from "./hash.js";
 import { resolvePatRoles } from "./roles.js";

package/dist/personal-access-tokens/revoke-for-user.js

@@ -1,4 +1,4 @@
-import { runnerCanBeginTransaction, transaction, updateMany, } from "@cosmicdrift/kumiko-framework/bun-db";
+import { runnerCanBeginTransaction, transaction, updateMany, } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { append } from "@cosmicdrift/kumiko-framework/event-store";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";

package/dist/personal-access-tokens/roles.js

@@ -1,10 +1,8 @@
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { buildSessionRoles } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
-// kumiko-lint-ignore cross-feature-import shared lifecycle-status gate with session auth
-import { isPrincipalBlocked } from "../sessions/index.js";
 import { tenantMembershipsTable } from "../tenant/index.js";
-import { userTable } from "../user/index.js";
+import { isPrincipalRowBlocked, userTable } from "../user/index.js";
 // Live role resolution for a (userId, tenantId), mirroring login.write.ts:
 // global roles (users.roles) ∪ tenant-membership roles (forbidden roles
 // stripped via stripForbiddenMembershipRoles, see engine/membership-roles).
@@ -26,7 +24,7 @@ export async function resolvePatRoles(db, userId, tenantId) {
     const userRow = await fetchOne(db, userTable, {
         id: userId,
     });
-    if (userRow && isPrincipalBlocked(userRow.status))
+    if (userRow && isPrincipalRowBlocked(userRow))
         return null;
     const globalRoles = parseRoles(userRow?.roles ?? null);
     return buildSessionRoles(globalRoles, parseRoles(membership.roles));

package/dist/personal-access-tokens/screens.js

@@ -16,6 +16,7 @@ const PAT_SCREEN_VISIBLE_WHEN = {
 export const patListScreen = {
     id: PAT_SCREEN_ID,
     type: "projectionList",
+    agent: { expose: false },
     visibleWhen: PAT_SCREEN_VISIBLE_WHEN,
     query: PatQueries.mine,
     // The `mine` handler honours `limit` only (no offset/total), so a pager would
@@ -97,6 +98,7 @@ export function createPatMintScreen(scopes) {
     return {
         id: PAT_MINT_SCREEN_ID,
         type: "secretMint",
+        agent: { expose: false },
         visibleWhen: PAT_SCREEN_VISIBLE_WHEN,
         handler: PatHandlers.create,
         fields: {