@cosmicdrift/kumiko-samples 0.365.0 → 0.366.0

package/packages/bundled-features/src/channel-slack/feature.ts

@@ -21,8 +21,8 @@ export function createChannelSlackFeature(options: SlackChannelOptions = {}): Fe
       category: "notifications",
       recommended: false,
     });
-    r.requires("delivery");
-    r.requires("secrets");
+    r.requires({ features: ["delivery"] });
+    r.requires({ features: ["secrets"] });
 
     const webhookTarget = resolveChatWebhookTarget(
       { defaultAllowedHosts: SLACK_DEFAULT_ALLOWED_HOSTS },

package/packages/bundled-features/src/channel-teams/feature.ts

@@ -21,8 +21,8 @@ export function createChannelTeamsFeature(options: TeamsChannelOptions = {}): Fe
       category: "notifications",
       recommended: false,
     });
-    r.requires("delivery");
-    r.requires("secrets");
+    r.requires({ features: ["delivery"] });
+    r.requires({ features: ["secrets"] });
 
     const webhookTarget = resolveChatWebhookTarget(
       { defaultAllowedHosts: TEAMS_DEFAULT_ALLOWED_HOSTS },

package/packages/bundled-features/src/channel-telegram/feature.ts

@@ -19,8 +19,8 @@ export function createChannelTelegramFeature(
       category: "notifications",
       recommended: false,
     });
-    r.requires("delivery");
-    r.requires("secrets");
+    r.requires({ features: ["delivery"] });
+    r.requires({ features: ["secrets"] });
 
     const botToken = r.secret("botToken", {
       label: { en: "Telegram bot token" },

package/packages/bundled-features/src/compliance-profiles/feature.ts

@@ -63,7 +63,7 @@ export function createComplianceProfilesFeature(
     // Context, Profile-Selection ist eigene Entity, sub-processor-Liste
     // sind Constants. Wenn S1.4+ Cross-Feature-Reads dazukommen, kommt
     // r.requires hier rein.
-    r.entity("tenant-compliance-profile", tenantComplianceProfileEntity);
+    r.entity({ name: "tenant-compliance-profile", ...tenantComplianceProfileEntity });
 
     r.exposesApi("compliance.forTenant");
 

package/packages/bundled-features/src/compliance-profiles-ops/index.ts

@@ -7,7 +7,7 @@
 // a separate feature (mirrors folders-user-data/notes-history-user-data)
 // rather than folded into compliance-profiles: this is the one genuinely
 // cross-tenant capability in the picker's orbit, and it alone needs
-// r.systemScope() + a hard r.requires("tenant") — apps that only want the
+// r.systemScope() + a hard r.requires({ features: ["tenant"] }) — apps that only want the
 // per-tenant picker (the vast majority) stay unaffected.
 
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
@@ -23,8 +23,8 @@ export const complianceProfilesOpsFeature = defineFeature("compliance-profiles-o
     recommended: false,
   });
   r.systemScope();
-  r.requires("compliance-profiles");
-  r.requires("tenant");
+  r.requires({ features: ["compliance-profiles"] });
+  r.requires({ features: ["tenant"] });
 
   const queries = {
     tenantsMissingProfile: r.queryHandler(tenantsMissingProfileQuery),

package/packages/bundled-features/src/config/feature.ts

@@ -45,7 +45,7 @@ export function createConfigFeature(): FeatureDefinition {
     // projection write in one TX. Subscribers that need config-change
     // semantics listen to those auto-events via r.multiStreamProjection
     // (see docs/plans/architecture/event-sourcing-pivot.md §4.7).
-    r.entity("config-value", configValueEntity);
+    r.entity({ name: "config-value", ...configValueEntity });
 
     const handlers = {
       set: r.writeHandler(setWrite),

package/packages/bundled-features/src/crypto-shredding/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.366.0",
+    "type": "fix",
+    "title": "forget-subject is covered for users stored before the KMS and users without an event stream",
+    "detail": "Tests now cover forget-subject for users stored as plaintext before the KMS was configured and for users without an event stream. Both succeed since the KMS tombstone fix, close the login door and write the audit event."
+  },
+  {
+    "version": "0.365.1",
+    "type": "fix",
+    "title": "eraseKey leaves a tombstone for subjects that never had a key",
+    "detail": "eraseKey now records an erased entry even when the subject has no key (pre-KMS plaintext). A later createKey or write for that subject fails with subject_erased instead of minting a fresh key and re-encrypting the plaintext. Erase flows must write with writePurpose erasure after eraseKey. kumiko_subject_keys now gets one tombstone row per forgotten record subject and per step dispatch. The tenant destruction stage tenant-row now fails loudly when marking the tenant destroyed does not succeed.",
+    "migration": "Run backfill-pii before erasing Pre-KMS data, otherwise untouched plaintext stays readable after eraseKey."
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/packages/bundled-features/src/custom-fields/feature.ts

@@ -10,7 +10,7 @@
 // (crypto-shredding, event ciphertext, forget pipeline).
 //
 // **Was diese Feature liefert (B1 + B2, 2026-05-23):**
-//   1. r.entity("field-definition") — Definition-Storage (event-sourced).
+//   1. r.entity({ name: "field-definition" }) — Definition-Storage (event-sourced).
 //   2. define-tenant-field / define-system-field — RBAC write-handlers für
 //      Definition-CRUD.
 //   3. delete-tenant-field / delete-system-field — RBAC write-handlers.
@@ -123,7 +123,7 @@ function registerCustomFields(
     category: "data",
     recommended: false,
   });
-  r.entity("field-definition", fieldDefinitionEntity);
+  r.entity({ name: "field-definition", ...fieldDefinitionEntity });
 
   // Event-types — qualified als "custom-fields:event:<short-name>".
   // Returned EventDefs liefern .name als compile-time literal-typed string,

package/packages/bundled-features/src/custom-fields/wire-for-entity.ts

@@ -44,8 +44,8 @@ export function customFieldsField(): JsonbFieldDef {
 // Consumer-side:
 //
 //   defineFeature("property-mgmt", (r) => {
-//     r.entity("property", propertyEntity);  // muss customFieldsField() haben
-//     r.requires(CUSTOM_FIELDS_FEATURE_NAME);
+//     r.entity({ name: "property", ...propertyEntity });  // muss customFieldsField() haben
+//     r.requires({ features: [CUSTOM_FIELDS_FEATURE_NAME] });
 //     wireCustomFieldsFor(r, "property", propertyTable);
 //   });
 //
@@ -198,18 +198,22 @@ export function wireCustomFieldsFor<TReg extends FeatureRegistrar<string>>(
 
   // postQuery-hook: flatten row.customFields jsonb auf root-level der
   // API-response. Spec-Promise Z.4 "indistinguishable von Stammfeldern".
-  r.hook("postQuery", { allOf: entityName }, async ({ rows }) => ({
-    rows: rows.map((row) => {
-      const customFields = row["customFields"];
-      if (customFields && typeof customFields === "object" && !Array.isArray(customFields)) {
-        return {
-          ...(customFields as Record<string, unknown>), // @cast-boundary db-row jsonb runtime-untyped
-          ...row, // base fields win: a custom fieldKey named `id`/`name` must not shadow the real column
-        };
-      }
-      return row;
+  r.hook({
+    type: "postQuery",
+    target: { allOf: entityName },
+    handler: async ({ rows }) => ({
+      rows: rows.map((row) => {
+        const customFields = row["customFields"];
+        if (customFields && typeof customFields === "object" && !Array.isArray(customFields)) {
+          return {
+            ...(customFields as Record<string, unknown>), // @cast-boundary db-row jsonb runtime-untyped
+            ...row, // base fields win: a custom fieldKey named `id`/`name` must not shadow the real column
+          };
+        }
+        return row;
+      }),
     }),
-  }));
+  });
 
   // Search-Payload-Extension: customFields-keys flach ins Index-Doc.
   // Anders als postQuery-hook (der ALLE keys merged) trägt der Search-

package/packages/bundled-features/src/data-retention/feature.ts

@@ -65,7 +65,7 @@ export function createDataRetentionFeature(): FeatureDefinition {
       category: "compliance",
       recommended: false,
     });
-    r.entity("tenant-retention-override", tenantRetentionOverrideEntity);
+    r.entity({ name: "tenant-retention-override", ...tenantRetentionOverrideEntity });
 
     // S2.D3: Cross-Feature-API fuer Forget-Flow + Cleanup-Job
     r.exposesApi("retention.policyFor");

package/packages/bundled-features/src/data-retention/presets.ts

@@ -13,10 +13,10 @@
 import type { RetentionDef } from "@cosmicdrift/kumiko-framework/engine";
 
 /**
- * Pro Entity-Name gemappte Retention-Policy. Entity-Namen sind der
- * String aus r.entity("name", ...) — kebab-case oder lowercase.
- * Cleanup-Job iteriert alle bekannten Entities; was nicht im Preset
- * steht, fällt auf Entity-Default (Layer 1) zurück.
+ * Retention policy keyed by entity name, i.e. the `name` from
+ * r.entity({ name, ... }) (kebab-case or lowercase). The cleanup job walks
+ * all known entities; anything missing from the preset falls back to the
+ * entity default (layer 1).
  */
 export type RetentionPreset = Readonly<Record<string, RetentionDef>>;
 

package/packages/bundled-features/src/delivery/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.366.0",
+    "type": "improvement",
+    "title": "Renaming a notification type keeps user preferences and address opt-outs",
+    "detail": "r.notification accepts renamedFrom, a list of former qualified names. Preferences and address opt-outs stored under a former name keep applying to the renamed notification, and a stored choice under the current name wins over one under a former name. New writes via setPreference and the unsubscribe and resubscribe handlers are stored under the current name, resubscribeAddress also lifts opt-outs under former names. Boot fails if an alias is a current notification name, is the wildcard, or is claimed by two notifications."
+  },
   {
     "version": "0.365.0",
     "type": "fix",

package/packages/bundled-features/src/delivery/db/queries/address-opt-outs.ts

@@ -16,14 +16,18 @@ export function addressOptOutKey(addressHash: string, channel: string): AddressO
 export async function selectOptedOutAddresses(
   db: DbConnection,
   tenantId: TenantId,
-  notificationType: string,
+  notificationTypeNames: readonly string[],
   addressHashes: readonly string[],
 ): Promise<ReadonlySet<AddressOptOutKey>> {
   if (addressHashes.length === 0) return new Set();
   const rows = await selectMany<{ readonly addressHash: string; readonly channel: string }>(
     db,
     notificationAddressOptOutsTable,
-    { tenantId, notificationType, addressHash: { in: addressHashes } },
+    {
+      tenantId,
+      notificationType: { in: notificationTypeNames },
+      addressHash: { in: addressHashes },
+    },
   );
   return new Set(rows.map((row) => addressOptOutKey(row.addressHash, row.channel)));
 }

package/packages/bundled-features/src/delivery/db/queries/preferences.ts

@@ -13,7 +13,7 @@ export async function selectNotificationPreferences(
   db: DbConnection,
   tenantId: TenantId,
   userId: string,
-  notificationType: string,
+  notificationTypeNames: readonly string[],
   channelName: string,
 ): Promise<readonly NotificationPreferenceRow[]> {
   return unsafeReadRetrying<NotificationPreferenceRow>(
@@ -23,10 +23,10 @@ export async function selectNotificationPreferences(
      WHERE tenant_id = $1
        AND user_id = $2
        AND (
-         (notification_type = $3 AND channel = $4)
+         (notification_type = ANY($3::text[]) AND channel = $4)
          OR (notification_type = '*' AND channel = $4)
-         OR (notification_type = $3 AND channel = '*')
+         OR (notification_type = ANY($3::text[]) AND channel = '*')
        )`,
-    [tenantId, userId, notificationType, channelName],
+    [tenantId, userId, notificationTypeNames, channelName],
   );
 }

package/packages/bundled-features/src/delivery/delivery-service.ts

@@ -44,6 +44,7 @@ import {
   selectOptedOutAddresses,
 } from "./db/queries/address-opt-outs.js";
 import { selectNotificationPreferences } from "./db/queries/preferences.js";
+import { notificationTypeNames } from "./notification-type-aliases.js";
 import {
   type ChannelContext,
   type ChannelMessage,
@@ -503,7 +504,12 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
       const addressHash = hashUnsubscribeAddress(address);
       if (addressHash !== undefined) addressHashes.add(addressHash);
     }
-    return selectOptedOutAddresses(run.db, tenantId, notificationType, [...addressHashes]);
+    return selectOptedOutAddresses(
+      run.db,
+      tenantId,
+      notificationTypeNames(registry, notificationType),
+      [...addressHashes],
+    );
   }
 
   function isAddressSuppressed(
@@ -617,7 +623,7 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
       run.db,
       tenantId,
       userId,
-      notificationType,
+      notificationTypeNames(registry, notificationType),
       channelName,
     );
 
@@ -629,6 +635,15 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
     );
     if (exact) return exact.enabled;
 
+    // Rows stored under a former name: the user's choice from before the rename
+    const aliasExact = prefs.filter(
+      (p) =>
+        p.notificationType !== "*" &&
+        p.notificationType !== notificationType &&
+        p.channel === channelName,
+    );
+    if (aliasExact.length > 0) return !aliasExact.some((p) => p.enabled === false);
+
     // Only wildcards matched: any disabled entry disables delivery (deterministic
     // and conservative — DB ordering no longer decides the outcome).
     return !prefs.some((p) => p.enabled === false);

package/packages/bundled-features/src/delivery/feature.ts

@@ -70,18 +70,22 @@ export function createDeliveryFeature(options?: DeliveryFeatureOptions): Feature
     });
     r.systemScope();
     // delivery-log's tenantId column has refEntity: "tenant:tenant" (boot-checked).
-    r.requires("tenant");
+    r.requires({ features: ["tenant"] });
     // Backing table: the (tenant,user,type,channel) uniqueIndex lives only on
     // the physical table, not on the entity fields, so the generator would
     // otherwise omit it → duplicate preference rows on concurrent upserts.
-    r.entity("notification-preference", notificationPreferenceEntity, {
-      table: notificationPreferencesTable,
+    r.entity({
+      name: "notification-preference",
+      ...notificationPreferenceEntity,
+      backingTable: notificationPreferencesTable,
     });
     // Same ride-along reason as notification-preference above: the
     // (tenant,addressHash,type,channel) uniqueIndex lives only on the
     // physical table.
-    r.entity("notification-address-opt-out", notificationAddressOptOutEntity, {
-      table: notificationAddressOptOutsTable,
+    r.entity({
+      name: "notification-address-opt-out",
+      ...notificationAddressOptOutEntity,
+      backingTable: notificationAddressOptOutsTable,
     });
     r.storeTable(deliveryAttemptsTableMeta, {
       reason: "read_side.delivery_attempt_log",

package/packages/bundled-features/src/delivery/handlers/resubscribe-address.write.ts

@@ -2,6 +2,7 @@ import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { removeAddressOptOut } from "../address-opt-out.js";
+import { currentNotificationType, notificationTypeNames } from "../notification-type-aliases.js";
 
 export const resubscribeAddressWrite = defineWriteHandler({
   name: "resubscribeAddress",
@@ -20,7 +21,8 @@ export const resubscribeAddressWrite = defineWriteHandler({
   description:
     "Removes a no-account address opt-out for one notificationType/channel combination; dispatched by the signed resubscribe route, not meant for UI callers.",
   handler: async (event, ctx) => {
-    const { addressHash, notificationType, channel } = event.payload;
+    const { addressHash, channel } = event.payload;
+    const notificationType = currentNotificationType(ctx.registry, event.payload.notificationType);
     const { tenantId } = event.user;
 
     if (!ctx.systemDb) {
@@ -30,13 +32,15 @@ export const resubscribeAddressWrite = defineWriteHandler({
     }
     const db = ctx.systemDb.assertTenantMatch(tenantId);
 
-    const result = await removeAddressOptOut(db, event.user, {
-      tenantId,
-      addressHash,
-      notificationType,
-      channel,
-    });
-    if (!result.isSuccess) return result;
+    for (const name of notificationTypeNames(ctx.registry, notificationType)) {
+      const result = await removeAddressOptOut(db, event.user, {
+        tenantId,
+        addressHash,
+        notificationType: name,
+        channel,
+      });
+      if (!result.isSuccess) return result;
+    }
     return { isSuccess: true, data: { notificationType, channel } };
   },
 });

package/packages/bundled-features/src/delivery/handlers/resubscribe-user.write.ts

@@ -1,6 +1,7 @@
 import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { currentNotificationType } from "../notification-type-aliases.js";
 import { upsertPreference } from "../upsert-preference.js";
 
 export const resubscribeUserWrite = defineWriteHandler({
@@ -18,7 +19,8 @@ export const resubscribeUserWrite = defineWriteHandler({
   description:
     "Re-enables one notification type and channel combination for the userId carried in a verified unsubscribe token; dispatched by the signed resubscribe route, not meant for UI callers.",
   handler: async (event, ctx) => {
-    const { userId, notificationType, channel } = event.payload;
+    const { userId, channel } = event.payload;
+    const notificationType = currentNotificationType(ctx.registry, event.payload.notificationType);
     const { tenantId } = event.user;
 
     if (!ctx.systemDb) {

package/packages/bundled-features/src/delivery/handlers/set-preference.write.ts

@@ -1,6 +1,7 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { currentNotificationType } from "../notification-type-aliases.js";
 import { upsertPreference } from "../upsert-preference.js";
 
 export const setPreferenceWrite = defineWriteHandler({
@@ -21,7 +22,8 @@ export const setPreferenceWrite = defineWriteHandler({
   description:
     "Enables or disables one notification type and channel combination for the calling user, where either side may be the wildcard * as a catch-all; use it when a user changes their own notification settings.",
   handler: async (event, ctx) => {
-    const { notificationType, channel, enabled } = event.payload;
+    const { channel, enabled } = event.payload;
+    const notificationType = currentNotificationType(ctx.registry, event.payload.notificationType);
     const { id: userId, tenantId } = event.user;
 
     // delivery runs in system-scope (feature.ts r.systemScope()) — ctx.systemDb

package/packages/bundled-features/src/delivery/handlers/unsubscribe-address.write.ts

@@ -2,6 +2,7 @@ import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { upsertAddressOptOut } from "../address-opt-out.js";
+import { currentNotificationType } from "../notification-type-aliases.js";
 
 export const unsubscribeAddressWrite = defineWriteHandler({
   name: "unsubscribeAddress",
@@ -18,7 +19,8 @@ export const unsubscribeAddressWrite = defineWriteHandler({
   description:
     "Records a no-account address opt-out for one notificationType/channel combination; dispatched by the signed unsubscribe route, not meant for UI callers.",
   handler: async (event, ctx) => {
-    const { addressHash, notificationType, channel } = event.payload;
+    const { addressHash, channel } = event.payload;
+    const notificationType = currentNotificationType(ctx.registry, event.payload.notificationType);
     const { tenantId } = event.user;
 
     if (!ctx.systemDb) {

package/packages/bundled-features/src/delivery/handlers/unsubscribe-user.write.ts

@@ -1,6 +1,7 @@
 import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { currentNotificationType } from "../notification-type-aliases.js";
 import { upsertPreference } from "../upsert-preference.js";
 
 export const unsubscribeUserWrite = defineWriteHandler({
@@ -20,7 +21,8 @@ export const unsubscribeUserWrite = defineWriteHandler({
   handler: async (event, ctx) => {
     // userId comes from the payload, not event.user.id — the caller here is
     // the system user dispatchSystemWrite runs as, not the user unsubscribing.
-    const { userId, notificationType, channel } = event.payload;
+    const { userId, channel } = event.payload;
+    const notificationType = currentNotificationType(ctx.registry, event.payload.notificationType);
     const { tenantId } = event.user;
 
     if (!ctx.systemDb) {

package/packages/bundled-features/src/delivery/notification-type-aliases.ts

@@ -0,0 +1,13 @@
+import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
+
+export function notificationTypeNames(registry: Registry, type: string): readonly string[] {
+  const renamedFrom = registry.getAllNotifications().get(type)?.renamedFrom ?? [];
+  return [type, ...renamedFrom];
+}
+
+export function currentNotificationType(registry: Registry, type: string): string {
+  for (const [name, definition] of registry.getAllNotifications()) {
+    if (definition.renamedFrom?.includes(type)) return name;
+  }
+  return type;
+}

package/packages/bundled-features/src/derivatives-sharp/feature.ts

@@ -15,7 +15,7 @@ export const derivativesSharpFeature = defineFeature(FEATURE_NAME, (r) => {
     category: "storage",
     recommended: false,
   });
-  r.requires("file-derivatives");
+  r.requires({ features: ["file-derivatives"] });
 
   const plugin: DerivativeRendererPlugin = { render: renderImage };
   r.useExtension(EXT_DERIVATIVE_RENDERER, "image/*", plugin);

package/packages/bundled-features/src/document-ingest-foundation/feature.ts

@@ -132,9 +132,9 @@ export const documentIngestFoundationFeature = defineFeature(FEATURE_NAME, (r) =
   });
   // tenant-lifecycle hosts EXT_TENANT_DATA — documentExtract.pages is
   // tenant-subject ciphertext and needs the destroy hook below.
-  r.requires("config", "tenant-lifecycle");
+  r.requires({ features: ["config", "tenant-lifecycle"] });
 
-  r.entity("documentExtract", documentExtractEntity);
+  r.entity({ name: "documentExtract", ...documentExtractEntity });
   r.useExtension(EXT_TENANT_DATA, "documentExtract", {
     destroy: documentExtractTenantDestroyHook,
   });

package/packages/bundled-features/src/file-derivatives/feature.ts

@@ -111,12 +111,12 @@ export function createFileDerivativesFeature(opts: FileDerivativesOptions = {}):
     });
     // Needs a storage provider to read the original + write the variant —
     // without file-foundation there's nothing to derive from or write to.
-    r.requires("file-foundation");
+    r.requires({ features: ["file-foundation"] });
     // variant() reads fileRefsTable, which "files" (not file-foundation)
     // owns — without this, mounting file-derivatives + file-foundation
     // alone boots fine but fails at request-time with a SQL error the first
     // time variant() runs.
-    r.requires("files");
+    r.requires({ features: ["files"] });
 
     r.extendsRegistrar(EXT_DERIVATIVE_RENDERER, {
       onRegister: () => {
@@ -164,7 +164,7 @@ export function createFileDerivativesFeature(opts: FileDerivativesOptions = {}):
         // tenant's public variants from staying reachable — require the
         // dependency so a missing mount fails boot, not the tenant check
         // silently no-op-ing at request time.
-        r.requires("tenant");
+        r.requires({ features: ["tenant"] });
         r.queryHandler(publicVariantByFileRefQuery);
       }
 

package/packages/bundled-features/src/file-foundation/feature.ts

@@ -46,7 +46,7 @@ export const fileFoundationFeature = defineFeature(FEATURE_NAME, (r) => {
     category: "storage",
     recommended: false,
   });
-  r.requires("config");
+  r.requires({ features: ["config"] });
 
   r.extendsRegistrar(EXT_FILE_PROVIDER, {
     onRegister: () => {

package/packages/bundled-features/src/file-provider-inmemory/feature.ts

@@ -68,10 +68,10 @@ export const fileProviderInMemoryFeature = defineFeature(FEATURE_NAME, (r) => {
     category: "storage",
     recommended: false,
   });
-  // Kein r.requires("config") + kein r.requires("secrets") — der
+  // Kein requires auf "config" oder "secrets" — der
   // In-Memory-Provider hat keine Config + kein Secret. Nur die
   // file-foundation muss da sein (Plugin-extension-point).
-  r.requires("file-foundation");
+  r.requires({ features: ["file-foundation"] });
 
   const plugin: FileProviderPlugin = {
     build: async (_ctx: FileProviderContext, tenantId: string): Promise<FileStorageProvider> => {

package/packages/bundled-features/src/file-provider-s3/feature.ts

@@ -47,9 +47,9 @@ export const fileProviderS3Feature = defineFeature(FEATURE_NAME, (r) => {
     category: "storage",
     recommended: false,
   });
-  r.requires("config");
-  r.requires("secrets");
-  r.requires("file-foundation");
+  r.requires({ features: ["config"] });
+  r.requires({ features: ["secrets"] });
+  r.requires({ features: ["file-foundation"] });
 
   const secretAccessKey = r.secret("s3.secretAccessKey", {
     label: { en: "S3 secret access key" },

package/packages/bundled-features/src/file-provider-s3-env/feature.ts

@@ -42,10 +42,10 @@ export const fileProviderS3EnvFeature = defineFeature(FEATURE_NAME, (r) => {
     category: "storage",
     recommended: false,
   });
-  // No r.requires("config") / r.requires("secrets") — credentials come from
+  // No requires on "config" or "secrets" — credentials come from
   // env, not the per-tenant config + secrets store. Only the file-foundation
   // plugin-extension-point must be mounted.
-  r.requires("file-foundation");
+  r.requires({ features: ["file-foundation"] });
 
   const plugin: FileProviderPlugin = {
     // tenantId ignored: one shared bucket serves all tenants (isolation via

package/packages/bundled-features/src/files/README.md

@@ -5,7 +5,7 @@ Sprint-1.5 Refactor (Pre-Sprint-2).
 
 ## Was es macht
 
-Deklariert `r.entity("fileRef", ...)` für die DB-Tabelle die das
+Deklariert `r.entity({ name: "fileRef", ... })` für die DB-Tabelle die das
 Framework via `createFileRoutes` (multipart-Upload + binary-Download)
 bewirtschaftet. Das öffnet die Tür für Cross-Feature-Hooks:
 

package/packages/bundled-features/src/files-tenant-data/index.ts

@@ -39,7 +39,7 @@ export function createFilesTenantDataFeature(): FeatureDefinition {
       category: "compliance",
       recommended: false,
     });
-    r.requires("tenant-lifecycle");
+    r.requires({ features: ["tenant-lifecycle"] });
     r.optionalRequires("files");
 
     r.useExtension(EXT_TENANT_DATA, "fileRef", { destroy: fileRefTenantDestroyHook });

package/packages/bundled-features/src/folders/feature.ts

@@ -58,8 +58,8 @@ function registerFolders(
   if (toggleable !== undefined) r.toggleable(toggleable);
 
   const folderAssignmentEntity = createFolderAssignmentEntity(ownership, parents);
-  r.entity("folder", folderEntity);
-  r.entity("folder-assignment", folderAssignmentEntity);
+  r.entity({ name: "folder", ...folderEntity });
+  r.entity({ name: "folder-assignment", ...folderAssignmentEntity });
 
   // Folder catalog — plain CRUD, no custom logic. update is rename (and, in a
   // later stage, reparent: it accepts changes.parentId, optimistic-locked).

package/packages/bundled-features/src/folders-user-data/index.ts

@@ -20,7 +20,7 @@ export const foldersUserDataFeature = defineFeature("folders-user-data", (r) =>
   // OPTIONAL: if it's mounted toggleable(default=false) (e.g. per-tenant via
   // tier), a hard r.requires would throw an "effectively disabled" boot
   // warning even though the folder entities exist and the hooks work fine.
-  r.requires("user-data-rights");
+  r.requires({ features: ["user-data-rights"] });
   r.optionalRequires("folders");
   r.useExtension(EXT_USER_DATA, "folder", {
     export: folderExportHook,

package/packages/bundled-features/src/form-draft/feature.ts

@@ -30,11 +30,11 @@ function registerFormDraft(r: FeatureRegistrar<typeof FORM_DRAFT_FEATURE_NAME>):
   // config is optional: the retention-days key only resolves when the
   // config feature is mounted (ctx.configResolver present) — the cleanup
   // job already falls back to FORM_DRAFT_DEFAULT_RETENTION_DAYS otherwise
-  // (see handlers/cleanup.job.ts). A hard r.requires("config") would break
+  // (see handlers/cleanup.job.ts). A hard r.requires({ features: ["config"] }) would break
   // every app that mounts form-draft without config, which is a breaking
   // change no minor/patch release should introduce silently.
   r.optionalRequires("config");
-  r.entity("form-draft", formDraftEntity);
+  r.entity({ name: "form-draft", ...formDraftEntity });
 
   r.writeHandler(saveDraftWrite);
   r.writeHandler(discardDraftWrite);

package/packages/bundled-features/src/form-draft-user-data/index.ts

@@ -12,7 +12,7 @@ export const formDraftUserDataFeature = defineFeature("form-draft-user-data", (r
   r.describe(
     "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `form-draft` feature's `form-draft` entity. Mounts the EXT_USER_DATA export hook so a user's saved drafts are included in the user-data export bundle, and a delete hook that physically removes the user's own draft rows on forget. Kept separate from `form-draft` so form-draft consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `form-draft`.",
   );
-  r.requires("user-data-rights");
+  r.requires({ features: ["user-data-rights"] });
   r.optionalRequires("form-draft");
   r.useExtension(EXT_USER_DATA, "form-draft", {
     export: formDraftExportHook,