@cosmicdrift/kumiko-bundled-features 0.367.0 → 0.369.0

package/dist/readiness/feature.d.ts

@@ -1,3 +1,11 @@
+export declare function createReadinessFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: {
+        queries: {
+            status: import("@cosmicdrift/kumiko-types/handlers").HandlerRef;
+        };
+    };
+};
+/** @deprecated Use createReadinessFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const readinessFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: {
         queries: {

package/dist/readiness/feature.js

@@ -9,17 +9,21 @@
 // `ready` boolean — the settings-checklist call for admin UIs.
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { statusQuery } from "./handlers/status.query.js";
-export const readinessFeature = defineFeature("readiness", (r) => {
-    r.describe("One-call tenant-onboarding probe: `readiness:query:status` rolls up every config key and secret declared `required: true` across all mounted features and reports which still lack a usable value for the calling tenant, plus a single `ready` boolean. Provider-features under an `r.extensionSelector`-declared extension point count only while their provider is the selected one — a tenant on the inmemory mail transport is not blocked by unset SMTP keys. Mount it (together with `config` and `secrets`) when an admin UI needs a settings checklist before the first mail-send or file-write; the per-concern lists stay available via `config:query:readiness` and `secrets:query:list`.");
-    r.uiHints({
-        displayLabel: "Readiness · Onboarding Probe",
-        category: "operations",
-        recommended: false,
-    });
-    r.requires({ features: ["config"] });
-    r.requires({ features: ["secrets"] });
-    const queries = {
-        status: r.queryHandler(statusQuery),
-    };
-    return { queries };
-});
+export function createReadinessFeature() {
+    return defineFeature("readiness", (r) => {
+        r.describe("One-call tenant-onboarding probe: `readiness:query:status` rolls up every config key and secret declared `required: true` across all mounted features and reports which still lack a usable value for the calling tenant, plus a single `ready` boolean. Provider-features under an `r.extensionSelector`-declared extension point count only while their provider is the selected one — a tenant on the inmemory mail transport is not blocked by unset SMTP keys. Mount it (together with `config` and `secrets`) when an admin UI needs a settings checklist before the first mail-send or file-write; the per-concern lists stay available via `config:query:readiness` and `secrets:query:list`.");
+        r.uiHints({
+            displayLabel: "Readiness · Onboarding Probe",
+            category: "operations",
+            recommended: false,
+        });
+        r.requires({ features: ["config"] });
+        r.requires({ features: ["secrets"] });
+        const queries = {
+            status: r.queryHandler(statusQuery),
+        };
+        return { queries };
+    }, { dedupeOptions: {} });
+}
+/** @deprecated Use createReadinessFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const readinessFeature = createReadinessFeature();

package/dist/readiness/index.d.ts

@@ -1,3 +1,3 @@
 export { READINESS_FEATURE, ReadinessQueries } from "./constants.js";
-export { readinessFeature } from "./feature.js";
+export { createReadinessFeature, readinessFeature } from "./feature.js";
 export type { ReadinessMissingSecret } from "./handlers/status.query.js";

package/dist/readiness/index.js

@@ -1,2 +1,2 @@
 export { READINESS_FEATURE, ReadinessQueries } from "./constants.js";
-export { readinessFeature } from "./feature.js";
+export { createReadinessFeature, readinessFeature } from "./feature.js";

package/dist/secrets/db/queries/read.js

@@ -1,4 +1,4 @@
-import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/db";
 export async function selectTenantSecretEnvelope(db, tenantId, key) {
     const rows = await asRawClient(db).unsafe(`SELECT envelope FROM read_tenant_secrets WHERE tenant_id = $1 AND key = $2 LIMIT 1`, [tenantId, key]);
     return rows[0]?.envelope;

package/dist/secrets/feature.d.ts

@@ -22,9 +22,13 @@ export declare const secretsEnvSchema: z.ZodObject<{
 }, z.core.$strip>;
 export { createSecretsContext, type SecretsContext, type SecretsContextOptions, TENANT_SECRET_READ_EVENT, } from "./secrets-context.js";
 export { type StoredEnvelope, type StoredMetadata, tenantSecretsTable } from "./table.js";
+export declare const JOIN_REQUEST_TRANSACTION_REASON = "the secret write runs on the request transaction so a failing batch rolls it back together with the config writes";
 export declare function requireSecretsContext(ctx: {
     readonly secrets?: SecretsContext;
     readonly _userId?: string | undefined;
+    readonly user?: {
+        readonly id: string;
+    };
 }, handlerName: string): SecretsContext;
 export type SecretsFeatureOptions = {
     /** Access rule for the `set`, `delete` and `list` handlers. Default

package/dist/secrets/feature.js

@@ -1,4 +1,4 @@
-import { defineFeature, } from "@cosmicdrift/kumiko-framework/engine";
+import { defineFeature, SYSTEM_ROLE, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { SETTINGS_HUB_I18N } from "@cosmicdrift/kumiko-framework/i18n";
 import * as z from "zod";
@@ -44,6 +44,9 @@ export const secretsEnvSchema = z.object({
 });
 export { createSecretsContext, TENANT_SECRET_READ_EVENT, } from "./secrets-context.js";
 export { tenantSecretsTable } from "./table.js";
+// The settings form saves config values and secrets in one /api/batch; the secret
+// write has to join that transaction so a rejected command rolls it back too.
+export const JOIN_REQUEST_TRANSACTION_REASON = "the secret write runs on the request transaction so a failing batch rolls it back together with the config writes";
 // AppContext carries ctx.secrets via extraContext. requireSecretsContext
 // wraps that raw context so every `.get(...)` call auto-includes the
 // current user + handler as audit metadata — feature code can't forget
@@ -53,6 +56,7 @@ export { tenantSecretsTable } from "./table.js";
 // FileProviderContext-Pfade (S3-Plugin im Worker) liefern dieselben
 // zwei Felder, also reicht die schmale ctx-shape — kein voller
 // HandlerContext-Import noetig.
+// Handler contexts carry the caller as ctx.user, provider contexts set _userId (takes precedence).
 export function requireSecretsContext(ctx, handlerName) {
     if (!ctx.secrets) {
         throw new InternalError({
@@ -60,10 +64,10 @@ export function requireSecretsContext(ctx, handlerName) {
                 "createSecretsContext({db, masterKeyProvider, registry}) via extraContext.secrets at boot.",
         });
     }
-    const userId = ctx._userId;
+    const userId = ctx._userId ?? ctx.user?.id;
     if (!userId) {
         throw new InternalError({
-            message: `[${handlerName}] ctx._userId missing — cannot audit secret reads without a caller identity.`,
+            message: `[${handlerName}] ctx._userId missing (and no ctx.user) — cannot audit secret reads without a caller identity.`,
         });
     }
     const withAudit = (raw) => ({
@@ -89,10 +93,19 @@ function resolveSecretsAccess(opts) {
         return { roles: opts.roles };
     return DEFAULT_SECRETS_ACCESS;
 }
+// Server-side system writes (dispatchSystemWrite, e.g. a wire hook migrating credentials) take the
+// same declared-key gate, value check and cache-sync announce as an admin instead of bypassing them
+// via SecretsContext.set. The system role is in-process only and never minted into a session.
+function withSystemWriter(rule) {
+    if (!("roles" in rule) || rule.roles.includes(SYSTEM_ROLE))
+        return rule;
+    return { ...rule, roles: [SYSTEM_ROLE, ...rule.roles] };
+}
 export function createSecretsFeature(opts = {}) {
     const access = resolveSecretsAccess(opts);
+    const writeAccess = withSystemWriter(access);
     return defineFeature(SECRETS_FEATURE_NAME, (r) => {
-        r.describe('Stores arbitrary per-tenant secrets (API keys, tokens, credentials) encrypted at rest using AES-256 with a KEK loaded from `KUMIKO_SECRETS_MASTER_KEY_V1` (and successive versions for rotation). Read a secret in handlers via `ctx.secrets.get(tenantId, handle)`, which automatically appends a `tenantSecretRead` audit event so every access is traceable. A `rotate` job re-encrypts all envelopes after a KEK version bump. The `set`/`delete`/`list` handlers share one access rule — default { roles: ["TenantAdmin"] }; adopt the host\'s role vocabulary with createSecretsFeature({ roles }) or open it to every authenticated tenant user with { access: { openToAll: { reason } } } (larger blast radius: any tenant member can then read secret previews and write/delete secrets, not just admins).');
+        r.describe('Stores arbitrary per-tenant secrets (API keys, tokens, credentials) encrypted at rest using AES-256 with a KEK loaded from `KUMIKO_SECRETS_MASTER_KEY_V1` (and successive versions for rotation). Read a secret in handlers via `ctx.secrets.get(tenantId, handle)`, which automatically appends a `tenantSecretRead` audit event so every access is traceable. A `rotate` job re-encrypts all envelopes after a KEK version bump. The `set`/`delete`/`list` handlers share one access rule — default { roles: ["TenantAdmin"] }; adopt the host\'s role vocabulary with createSecretsFeature({ roles }) or open it to every authenticated tenant user with { access: { openToAll: { reason } } } (larger blast radius: any tenant member can then read secret previews and write/delete secrets, not just admins). Server-side code writes a tenant secret with `dispatchSystemWrite({ handlerQn: "secrets:write:set", payload, tenantId })`: set and delete also admit the in-process system identity, so such writes pass the same declared-key and value checks.');
         r.uiHints({
             displayLabel: "Tenant Secrets",
             category: "infrastructure",
@@ -127,8 +140,8 @@ export function createSecretsFeature(opts = {}) {
         // The rotation job deliberately reaches for ctx.db.unsafeRaw() (raw,
         // cross-tenant) because rotation is a deployment-wide operation — no
         // feature-wide r.systemScope() needed.
-        r.writeHandler(createSetHandler(access));
-        r.writeHandler(createDeleteHandler(access));
+        r.writeHandler(createSetHandler(writeAccess));
+        r.writeHandler(createDeleteHandler(writeAccess));
         r.queryHandler(createListHandler(access));
         // Manual-only by design: ops triggers rotation after a KEK version flip.
         // BullMQ delivers to exactly one worker, so running it against a busy

package/dist/secrets/handlers/delete.write.js

@@ -3,7 +3,7 @@ import { failNotFound } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { announceSecretChange } from "../announce-secret-change.js";
 import { DEFAULT_SECRETS_ACCESS } from "../constants.js";
-import { requireSecretsContext } from "../feature.js";
+import { JOIN_REQUEST_TRANSACTION_REASON, requireSecretsContext } from "../feature.js";
 import { checkSecretKeyWrite } from "../write-gate.js";
 export function createDeleteHandler(access = DEFAULT_SECRETS_ACCESS) {
     return defineWriteHandler({
@@ -14,8 +14,9 @@ export function createDeleteHandler(access = DEFAULT_SECRETS_ACCESS) {
             key: z.string().min(1).max(100),
         }),
         access,
+        escapeHatch: { grants: ["unsafeRaw"], reason: JOIN_REQUEST_TRANSACTION_REASON },
         handler: async (event, ctx) => {
-            const secrets = requireSecretsContext(ctx, "secrets:write:delete");
+            const secrets = requireSecretsContext(ctx, "secrets:write:delete").withRunner(ctx.db.unsafeRaw());
             const gate = checkSecretKeyWrite(ctx.registry, event.user.roles, event.payload.key, {
                 allowUndeclared: true,
             });

package/dist/secrets/handlers/rotate.job.js

@@ -16,8 +16,7 @@
 // check to the executor's stream-version check; a parallel secrets.set
 // that landed the row on the new kekVersion first surfaces here as a
 // version_conflict error (counted as "skipped", not "failed").
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb, selectMany, } from "@cosmicdrift/kumiko-framework/db";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { decodeStoredEnvelope, encodeStoredEnvelope, rewrapDek, } from "@cosmicdrift/kumiko-framework/secrets";
 import { runChunkedMigration } from "../../shared/index.js";
@@ -48,7 +47,7 @@ export async function rotateJob(rawPayload, ctx, db) {
     function tdbFor(tenantId) {
         let existing = tdbCache.get(tenantId);
         if (!existing) {
-            existing = createTenantDb(db, tenantId, "system");
+            existing = createTenantDb({ db, tenantId, mode: "system" });
             tdbCache.set(tenantId, existing);
         }
         return existing;

package/dist/secrets/handlers/set.write.js

@@ -2,7 +2,7 @@ import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { announceSecretChange } from "../announce-secret-change.js";
 import { DEFAULT_SECRETS_ACCESS } from "../constants.js";
-import { requireSecretsContext } from "../feature.js";
+import { JOIN_REQUEST_TRANSACTION_REASON, requireSecretsContext } from "../feature.js";
 import { checkSecretKeyWrite, checkSecretValue } from "../write-gate.js";
 export function createSetHandler(access = DEFAULT_SECRETS_ACCESS) {
     return defineWriteHandler({
@@ -21,8 +21,9 @@ export function createSetHandler(access = DEFAULT_SECRETS_ACCESS) {
             hint: z.string().max(200).optional(),
         }),
         access,
+        escapeHatch: { grants: ["unsafeRaw"], reason: JOIN_REQUEST_TRANSACTION_REASON },
         handler: async (event, ctx) => {
-            const secrets = requireSecretsContext(ctx, "secrets:write:set");
+            const secrets = requireSecretsContext(ctx, "secrets:write:set").withRunner(ctx.db.unsafeRaw());
             const { key, value, redactedPreview, hint } = event.payload;
             // Preview-priority: explicit payload param > feature-declared redact
             // (via r.secret()) > generic default. A feature that declared a

package/dist/secrets/secrets-context.js

@@ -11,8 +11,7 @@
 //           race on the secret's own version). The audit invariant ("every
 //           read logged") now sits on the events-table instead of a
 //           dedicated audit-table.
-import { fetchOne, transaction } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb, fetchOne, transaction, } from "@cosmicdrift/kumiko-framework/db";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { append } from "@cosmicdrift/kumiko-framework/event-store";
 import { createDekCache, createSecret, decodeStoredEnvelope, decryptValue, encodeStoredEnvelope, encryptValue, withDekCache, } from "@cosmicdrift/kumiko-framework/secrets";
@@ -140,7 +139,7 @@ function buildSecretsContext(opts, provider, db, runnerIsTransaction) {
                 tenantId,
                 roles: SYSTEM_ROLES,
             };
-            const tdb = createTenantDb(db, tenantId, "system");
+            const tdb = createTenantDb({ db, tenantId, mode: "system" });
             const existing = await lookup(tenantId, key);
             const commonFields = {
                 envelope: stored,
@@ -194,7 +193,7 @@ function buildSecretsContext(opts, provider, db, runnerIsTransaction) {
                 tenantId,
                 roles: SYSTEM_ROLES,
             };
-            const tdb = createTenantDb(db, tenantId, "system");
+            const tdb = createTenantDb({ db, tenantId, mode: "system" });
             const result = await executor.delete({ id: existing.id }, actor, tdb);
             return result.isSuccess;
         },

package/dist/sessions/db/queries/cleanup.js

@@ -1,4 +1,4 @@
-import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/db";
 export async function deleteStaleSessionsBatch(db, olderThanDays, batchSize) {
     const rows = await asRawClient(db).unsafe(`DELETE FROM "store_user_sessions"
      WHERE "id" IN (

package/dist/sessions/handlers/detail.query.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared/index.js";

package/dist/sessions/handlers/list.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, definePagedQueryHandler, MAX_LIST_LIMIT, } from "@cosmicdrift/kumiko-framework/engine";
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
@@ -6,7 +6,7 @@ import { decryptStoredPii } from "../../shared/index.js";
 import { userSessionTable } from "../schema/user-session.js";
 // `sort` arrives raw from the client's query string. selectMany's orderBy
 // has no column-existence check — an unrecognised field just gets
-// snake_cased and quoted as-is (bun-db/query.ts columnOf) — so this
+// snake_cased and quoted as-is (db/query.ts columnOf) — so this
 // allowlist is what stops a client sorting by ip/userAgent or any other
 // non-exposed column.
 const SORTABLE_COLUMNS = ["id", "userId", "createdAt", "expiresAt", "revokedAt"];

package/dist/sessions/handlers/mine.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { definePagedQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared/index.js";

package/dist/sessions/handlers/revoke-all-for-user.write.js

@@ -1,5 +1,5 @@
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
-import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { updateMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineWriteHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { append } from "@cosmicdrift/kumiko-framework/event-store";

package/dist/sessions/handlers/revoke-all-others.write.js

@@ -1,4 +1,4 @@
-import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { updateMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";

package/dist/sessions/handlers/revoke.write.js

@@ -1,4 +1,4 @@
-import { fetchOne, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, updateMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";

package/dist/sessions/session-callbacks.js

@@ -1,11 +1,11 @@
-import { fetchOne, insertOne, transaction, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, insertOne, transaction, updateMany } from "@cosmicdrift/kumiko-framework/db";
 import { buildSessionRoles, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { append } from "@cosmicdrift/kumiko-framework/event-store";
 import { generateId, parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { encryptForDirectWrite } from "../shared/index.js";
 import { tenantMembershipsTable } from "../tenant/index.js";
-import { isPrincipalBlocked, userTable } from "../user/index.js";
+import { isPrincipalBlocked, isPrincipalRowBlocked, userTable, } from "../user/index.js";
 import { DEFAULT_SESSION_EXPIRY_MS, LAST_SEEN_REFRESH_MS, USER_SESSION_ENTITY_NAME, } from "./constants.js";
 import { userSessionEntity, userSessionTable } from "./schema/user-session.js";
 import { SESSION_REVOKED_AGGREGATE_TYPE, SESSION_REVOKED_EVENT_QN, sessionRevokedSchema, } from "./session-revoked-event.js";
@@ -112,16 +112,14 @@ export function createSessionCallbacks(opts) {
             // falls back to the JWT's frozen roles claim.
             let user;
             try {
-                user = await fetchOne(db, userTable, {
-                    id: expectedUserId,
-                });
+                user = await fetchOne(db, userTable, { id: expectedUserId });
             }
             catch {
                 return "live";
             }
             if (!user)
                 return "live";
-            if (isPrincipalBlocked(user.status))
+            if (isPrincipalRowBlocked(user))
                 return "blocked";
             // Same fail-open reasoning as the userTable lookup above — a transient
             // DB error on the membership read must not lock the user out. A

package/dist/sessions/testing.d.ts

@@ -1,6 +1,6 @@
 import type { AuthRoutesConfig, SessionCreator } from "@cosmicdrift/kumiko-framework/api";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
-import type { LateBoundHolder } from "@cosmicdrift/kumiko-framework/testing";
+import type { LateBoundHolder } from "@cosmicdrift/kumiko-testing/helpers";
 import type { SessionCallbacks, SessionMassRevoker } from "./session-callbacks.js";
 export type BoundSessionCallbacks = {
     /** auth-config fragment: creator + revoker + checker, all late-bound. */

package/dist/tags/feature.d.ts

@@ -2,7 +2,7 @@ import { type AccessRule, type EntityDefinition } from "@cosmicdrift/kumiko-fram
 type TagsToggleable = {
     readonly default: boolean;
 };
-export declare const tagsFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+declare const defaultTagsFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };
 export type TagsFeatureOptions = {
@@ -44,5 +44,9 @@ export type TagsFeatureOptions = {
      *  otherwise considers every registered entity as a candidate host. */
     readonly parents?: readonly string[];
 };
-export declare function createTagsFeature(opts?: TagsFeatureOptions): typeof tagsFeature;
+export declare function createTagsFeature(opts?: TagsFeatureOptions): typeof defaultTagsFeature;
+/** @deprecated Use createTagsFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export declare const tagsFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: void;
+};
 export {};

package/dist/tags/feature.js

@@ -84,7 +84,7 @@ function registerTags(r, access, toggleable, ownership, parents) {
     r.screen(createTagEditScreen(access));
     r.translations({ keys: TAGS_FEATURE_I18N });
 }
-export const tagsFeature = defineFeature(TAGS_FEATURE_NAME, (r) => registerTags(r, DEFAULT_TAG_ACCESS, undefined, undefined, undefined));
+const defaultTagsFeature = defineFeature(TAGS_FEATURE_NAME, (r) => registerTags(r, DEFAULT_TAG_ACCESS, undefined, undefined, undefined));
 function resolveAccess(opts) {
     if (opts.access !== undefined)
         return opts.access;
@@ -101,7 +101,7 @@ export function createTagsFeature(opts = {}) {
         opts.toggleable === undefined &&
         opts.ownership === undefined &&
         opts.parents === undefined) {
-        return tagsFeature;
+        return defaultTagsFeature;
     }
     if (opts.parents !== undefined && opts.parents.length === 0) {
         throw new Error("createTagsFeature({ parents }): parents must not be an empty array — " +
@@ -113,3 +113,5 @@ export function createTagsFeature(opts = {}) {
     const access = resolveAccess(opts);
     return defineFeature(TAGS_FEATURE_NAME, (r) => registerTags(r, access, opts.toggleable, opts.ownership, opts.parents));
 }
+/** @deprecated Use createTagsFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const tagsFeature = createTagsFeature();

package/dist/template-resolver/api.js

@@ -1,7 +1,7 @@
 // TemplateResolverApi — cross-feature interface. renderer-foundation,
 // delivery and apps import types ONLY and take the implementation from
 // ctx.templateResolver at runtime.
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { FALLBACK_LOCALE, SYSTEM_TENANT_ID } from "./constants.js";
 import { fileAttachmentsOf, imageLinksOf, parseLinkedResourceEntries, pdfAttachmentLinksOf, } from "./linked-resources.js";

package/dist/template-resolver/constants.d.ts

@@ -23,7 +23,6 @@ export declare const HEX_COLOR_PATTERN: RegExp;
 export declare const DEFAULT_MAIL_LAYOUT_SLUG = "default";
 export declare const DEFAULT_PDF_LAYOUT_SLUG = "default";
 export declare const MAIL_PREVIEW_MAX_BYTES: number;
-export declare const TEST_MAIL_NOTIFICATION_TYPE = "template-resolver:test-mail";
 export declare const TEST_MAIL_SUBJECT_PREFIX = "[TEST] ";
 export { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 export declare const FALLBACK_LOCALE = "de";

package/dist/template-resolver/constants.js

@@ -59,7 +59,6 @@ export const DEFAULT_MAIL_LAYOUT_SLUG = "default";
 export const DEFAULT_PDF_LAYOUT_SLUG = "default";
 // The mail transport enforces no size limit of its own; 10 MiB is a common provider ceiling.
 export const MAIL_PREVIEW_MAX_BYTES = 10 * 1024 * 1024;
-export const TEST_MAIL_NOTIFICATION_TYPE = "template-resolver:test-mail";
 export const TEST_MAIL_SUBJECT_PREFIX = "[TEST] ";
 // System-Templates leben unter der canonical SYSTEM_TENANT_ID-Sentinel-UUID.
 // Re-Export aus framework — single source of truth, vermeidet Drift.

package/dist/template-resolver/handlers/bundle-import.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { ValidationError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { requireForTenant } from "../../shared/index.js";
 import { attachmentLimitFailure, attachmentNeedsMailTemplate, createPreparedBundleResourceEntry, prepareTemplateAttachmentBeforeTransaction, prepareTemplateResourceBeforeTransaction, readTemplateResourceMaxBytes, releaseAll, } from "../store-template-resource.js";

package/dist/template-resolver/handlers/by-slug.query.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { TEXT_BLOCK_KIND } from "../constants.js";

package/dist/template-resolver/handlers/by-tenant.query.js

@@ -1,5 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { castTenantRows } from "@cosmicdrift/kumiko-framework/db";
+import { castTenantRows, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { TEXT_BLOCK_KIND } from "../constants.js";

package/dist/template-resolver/handlers/collection-item.query.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { collectionStore, DEFAULT_COLLECTION_ACCESS, toCollectionEntry, } from "./collection-shared.js";

package/dist/template-resolver/handlers/collection-list.query.js

@@ -1,5 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { castTenantRows } from "@cosmicdrift/kumiko-framework/db";
+import { castTenantRows, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { collectionStore, DEFAULT_COLLECTION_ACCESS, toCollectionEntry, } from "./collection-shared.js";

package/dist/template-resolver/handlers/collection-set.write.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { ValidationError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/dist/template-resolver/handlers/copy-locale.write.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, NotFoundError, ValidationError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";

package/dist/template-resolver/handlers/diff-to-system.query.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/dist/template-resolver/handlers/export-bundle.query.js

@@ -1,5 +1,5 @@
 import { isDeepStrictEqual } from "node:util";
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, ValidationError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/dist/template-resolver/handlers/find-by-id.query.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { templateResourcesTable } from "../table.js";

package/dist/template-resolver/handlers/layout-source.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { FALLBACK_LOCALE } from "../constants.js";

package/dist/template-resolver/handlers/list.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { TEMPLATE_KINDS, TEMPLATE_STATUSES } from "../constants.js";

package/dist/template-resolver/handlers/overview.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { DEFAULT_MAIL_LAYOUT_SLUG, FALLBACK_LOCALE } from "../constants.js";

package/dist/template-resolver/handlers/reset-to-system.write.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, ValidationError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/dist/template-resolver/handlers/resource-remove.write.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/dist/template-resolver/handlers/send-test.write.js

@@ -3,7 +3,7 @@ import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/
 import * as z from "zod";
 import { collectChannels, createEmailAttachmentReader, EMAIL_CHANNEL_NAME, } from "../../delivery/index.js";
 import { fileContextForTenant } from "../../file-foundation/index.js";
-import { TEST_MAIL_NOTIFICATION_TYPE, TEST_MAIL_SUBJECT_PREFIX } from "../constants.js";
+import { TEST_MAIL_SUBJECT_PREFIX } from "../constants.js";
 import { TemplateResolverErrors } from "../qualified-names.js";
 import { renderTemplatePreview } from "../template-preview.js";
 import { localeSchema, templateSlugSchema } from "./shared.js";
@@ -61,6 +61,7 @@ export const sendTestWrite = defineWriteHandler({
             sseBroker: undefined,
             tenantId: event.user.tenantId,
             secrets: ctx.secrets,
+            config: ctx.config,
             readAttachment: createEmailAttachmentReader(ctx.db, ctx.registry, event.user.tenantId, ctx.config, (tenantId) => fileContextForTenant(ctx, ctx.user.tenantId, tenantId)),
         };
         const address = (await channel.resolve?.(event.user.id, channelContext)) ?? null;
@@ -73,7 +74,8 @@ export const sendTestWrite = defineWriteHandler({
         let sentStatus;
         try {
             const result = await channel.send(address, {
-                notificationType: TEST_MAIL_NOTIFICATION_TYPE,
+                // The template slug is the notification name, so the test mail takes the transport the real mail takes.
+                notificationType: event.payload.slug,
                 title: subject,
                 body: undefined,
                 data: undefined,

package/dist/template-resolver/handlers/set.write.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";

package/dist/template-resolver/handlers/template-write.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, ValidationError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { requireForTenant } from "../../shared/index.js";

package/dist/template-resolver/handlers/tenant-overrides.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { TenantQueries } from "../../tenant/index.js";

package/dist/template-resolver/handlers/toggle-status.write.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, ValidationError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/dist/template-resolver/handlers/usage.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { TEMPLATE_KINDS } from "../constants.js";