@cosmicdrift/kumiko-samples 0.366.0 → 0.368.0

package/packages/bundled-features/src/notes-history/feature.ts

@@ -63,7 +63,7 @@ function registerNotesHistory(
   r.translations({ keys: NOTES_HISTORY_FEATURE_I18N });
 }
 
-export const notesHistoryFeature = defineFeature(NOTES_HISTORY_FEATURE_NAME, (r) =>
+const defaultNotesHistoryFeature = defineFeature(NOTES_HISTORY_FEATURE_NAME, (r) =>
   registerNotesHistory(r, DEFAULT_NOTES_HISTORY_ACCESS, undefined, undefined),
 );
 
@@ -114,14 +114,14 @@ function resolveAccess(opts: NotesHistoryFeatureOptions): AccessRule {
 // rebuild). access/roles/ownership build a fresh feature-definition.
 export function createNotesHistoryFeature(
   opts: NotesHistoryFeatureOptions = {},
-): typeof notesHistoryFeature {
+): typeof defaultNotesHistoryFeature {
   if (
     opts.access === undefined &&
     opts.roles === undefined &&
     opts.ownership === undefined &&
     opts.parents === undefined
   ) {
-    return notesHistoryFeature;
+    return defaultNotesHistoryFeature;
   }
   assertNoWhereRuleInOwnershipWrite("createNotesHistoryFeature", opts.ownership?.write);
   // A mount that accepts no parents at all can never take a note write —
@@ -138,3 +138,6 @@ export function createNotesHistoryFeature(
     registerNotesHistory(r, resolveAccess(opts), opts.ownership, opts.parents),
   );
 }
+
+/** @deprecated Use createNotesHistoryFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const notesHistoryFeature = createNotesHistoryFeature();

package/packages/bundled-features/src/notes-history/handlers/add-note.write.ts

@@ -1,4 +1,4 @@
-import { fetchOne, runInSavepointIfSupported } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, runInSavepointIfSupported } from "@cosmicdrift/kumiko-framework/db";
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { ValidationError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { decryptStoredPii, denyUnlessJoinRowParentVisible } from "../../shared/index.js";

package/packages/bundled-features/src/notes-history-user-data/hooks.ts

@@ -4,9 +4,9 @@
 // dependency. Mirrors job-run/delivery-attempt (user-data-rights-defaults):
 // export-only, erasure via crypto-shredding.
 
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, type SubjectId } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import type {
   TenantId,
   UserDataDeleteHook,

package/packages/bundled-features/src/notes-history-user-data/index.ts

@@ -15,22 +15,31 @@ import {
 
 export { eraseNoteBodiesReachingSubject } from "./hooks.js";
 
-export const notesHistoryUserDataFeature = defineFeature("notes-history-user-data", (r) => {
-  r.describe(
-    "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `notes-history` feature's `note-entry` and `note-mention` entities. Mounts the export hook so a user's authored notes are included in the user-data export bundle; the note-entry delete hook crypto-shreds the row-subject key of each note that structurally @-mentions the forgotten user (`note-mention`) or hangs on the user as host entity (regardless of the host entity's retention strategy: the note text is free PII, the host's anonymize/blockDelete protects the row, not the content), keeping the append-only history intact for all other notes. The manual `crypto-shredding` forget-subject command reaches the same notes for user and record subjects through the exported `eraseNoteBodiesReachingSubject`, and the export lists them under `note-mention`. `note-mention`'s own hooks are a no-op — it is a plain FK pointer, not separately exportable content. Kept separate from `notes-history` so notes consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `notes-history`.",
+export function createNotesHistoryUserDataFeature() {
+  return defineFeature(
+    "notes-history-user-data",
+    (r) => {
+      r.describe(
+        "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `notes-history` feature's `note-entry` and `note-mention` entities. Mounts the export hook so a user's authored notes are included in the user-data export bundle; the note-entry delete hook crypto-shreds the row-subject key of each note that structurally @-mentions the forgotten user (`note-mention`) or hangs on the user as host entity (regardless of the host entity's retention strategy: the note text is free PII, the host's anonymize/blockDelete protects the row, not the content), keeping the append-only history intact for all other notes. The manual `crypto-shredding` forget-subject command reaches the same notes for user and record subjects through the exported `eraseNoteBodiesReachingSubject`, and the export lists them under `note-mention`. `note-mention`'s own hooks are a no-op — it is a plain FK pointer, not separately exportable content. Kept separate from `notes-history` so notes consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `notes-history`.",
+      );
+      // user-data-rights is the hard dependency (EXT_USER_DATA host). notes-history
+      // is OPTIONAL: if it's mounted toggleable(default=false), a hard r.requires
+      // would throw an "effectively disabled" boot warning even though the
+      // note-entry entity exists and the hooks work fine.
+      r.requires({ features: ["user-data-rights"] });
+      r.optionalRequires("notes-history");
+      r.useExtension(EXT_USER_DATA, "note-entry", {
+        export: noteEntryExportHook,
+        delete: noteEntryDeleteHook,
+      });
+      r.useExtension(EXT_USER_DATA, "note-mention", {
+        export: noteMentionExportHook,
+        delete: noteMentionDeleteHook,
+      });
+    },
+    { dedupeOptions: {} },
   );
-  // user-data-rights is the hard dependency (EXT_USER_DATA host). notes-history
-  // is OPTIONAL: if it's mounted toggleable(default=false), a hard r.requires
-  // would throw an "effectively disabled" boot warning even though the
-  // note-entry entity exists and the hooks work fine.
-  r.requires({ features: ["user-data-rights"] });
-  r.optionalRequires("notes-history");
-  r.useExtension(EXT_USER_DATA, "note-entry", {
-    export: noteEntryExportHook,
-    delete: noteEntryDeleteHook,
-  });
-  r.useExtension(EXT_USER_DATA, "note-mention", {
-    export: noteMentionExportHook,
-    delete: noteMentionDeleteHook,
-  });
-});
+}
+
+/** @deprecated Use createNotesHistoryUserDataFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const notesHistoryUserDataFeature = createNotesHistoryUserDataFeature();

package/packages/bundled-features/src/personal-access-tokens/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.368.0",
+    "type": "improvement",
+    "title": "The token list screen takes a description and slots via listScreen",
+    "detail": "createPersonalAccessTokensFeature({ listScreen: { description, slots } }) sets the i18n description and the slots (for example a header component) of the api-tokens list, so an app can show instructions above the list and use the bundled screen directly instead of embedding it in its own dashboard. Without the option nothing changes. Both bundled token screens are now marked agent: { expose: false }, since the mint screen reveals the token plaintext."
+  },
   {
     "version": "0.365.0",
     "type": "fix",

package/packages/bundled-features/src/personal-access-tokens/feature.ts

@@ -4,7 +4,11 @@ import {
 } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { PAT_TOKEN_PREFIX } from "@cosmicdrift/kumiko-framework/api";
 import { deriveEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
-import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  defineFeature,
+  type FeatureDefinition,
+  type ProjectionListScreenDefinition,
+} from "@cosmicdrift/kumiko-framework/engine";
 import {
   API_TOKEN_ENTITY_NAME,
   PAT_DEFAULT_RATE_LIMIT,
@@ -68,6 +72,9 @@ export type PersonalAccessTokensOptions = {
    *  shown in place of the token screens when the tenant's tier excludes the
    *  feature, e.g. an upgrade notice. Default: the standard "unavailable" notice. */
   readonly lockedFallbackScreen?: string;
+  /** Description (i18n key) and slots rendered on the token list screen, e.g. an
+   *  explanatory text or a header component above the list. Default: neither. */
+  readonly listScreen?: Pick<ProjectionListScreenDefinition, "description" | "slots">;
   // Opt-in MFA re-auth gate for minting a token — wired via
   // mfaVerifierFromFeature (auth-mfa/feature.ts) at app-composition time. No
   // hard dependency on the optional auth-mfa feature.
@@ -176,7 +183,15 @@ export function createPersonalAccessTokensFeature(
     // places `patListScreen` via r.nav in its logged-in settings area.
     const lockedFallback =
       options.lockedFallbackScreen === undefined ? {} : { fallback: options.lockedFallbackScreen };
-    r.screen({ ...patListScreen, ...lockedFallback });
+    // Copy the two fields explicitly: a wider object passed as a variable
+    // escapes the Pick check and would override agent/access otherwise.
+    const { description, slots } = options.listScreen ?? {};
+    r.screen({
+      ...patListScreen,
+      ...(description === undefined ? {} : { description }),
+      ...(slots === undefined ? {} : { slots }),
+      ...lockedFallback,
+    });
     r.screen({ ...createPatMintScreen(scopes), ...lockedFallback });
     r.translations({ keys: { ...PAT_FEATURE_I18N, ...patScopeOptionTranslations(scopes) } });
 

package/packages/bundled-features/src/personal-access-tokens/handlers/create.write.ts

@@ -1,4 +1,4 @@
-import { insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { insertOne } from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
   defineWriteHandler,

package/packages/bundled-features/src/personal-access-tokens/handlers/list.query.ts

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { definePagedQueryHandler, MAX_LIST_LIMIT } from "@cosmicdrift/kumiko-framework/engine";
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
@@ -8,7 +8,7 @@ import { apiTokenTable } from "../schema/api-token.js";
 
 // `sort` arrives raw from the client's query string. selectMany's orderBy has
 // no column-existence check — an unrecognised field just gets snake_cased and
-// quoted as-is (bun-db/query.ts columnOf) — so this allowlist is what stops a
+// quoted as-is (db/query.ts columnOf) — so this allowlist is what stops a
 // client sorting by tokenHash or any other non-exposed column.
 const SORTABLE_COLUMNS = ["id", "name", "createdAt", "expiresAt", "revokedAt"] as const;
 type SortableColumn = (typeof SORTABLE_COLUMNS)[number];

package/packages/bundled-features/src/personal-access-tokens/handlers/revoke.write.ts

@@ -1,4 +1,4 @@
-import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { updateMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";

package/packages/bundled-features/src/personal-access-tokens/resolver.ts

@@ -1,6 +1,6 @@
 import type { TokenVerifier } from "@cosmicdrift/kumiko-framework/api";
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { isExpiredAt } from "./expiry.js";
 import { hashPatToken } from "./hash.js";

package/packages/bundled-features/src/personal-access-tokens/revoke-for-user.ts

@@ -1,9 +1,9 @@
+import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import {
   runnerCanBeginTransaction,
   transaction,
   updateMany,
-} from "@cosmicdrift/kumiko-framework/bun-db";
-import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+} from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { append } from "@cosmicdrift/kumiko-framework/event-store";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";

package/packages/bundled-features/src/personal-access-tokens/roles.ts

@@ -1,11 +1,9 @@
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { buildSessionRoles } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
-// kumiko-lint-ignore cross-feature-import shared lifecycle-status gate with session auth
-import { isPrincipalBlocked } from "../sessions/index.js";
 import { tenantMembershipsTable } from "../tenant/index.js";
-import { type UserStatus, userTable } from "../user/index.js";
+import { isPrincipalRowBlocked, type UserStatus, userTable } from "../user/index.js";
 
 // Live role resolution for a (userId, tenantId), mirroring login.write.ts:
 // global roles (users.roles) ∪ tenant-membership roles (forbidden roles
@@ -28,10 +26,14 @@ export async function resolvePatRoles(
   });
   const membership = memberships[0];
   if (!membership) return null;
-  const userRow = await fetchOne<{ roles: string | null; status: UserStatus }>(db, userTable, {
+  const userRow = await fetchOne<{
+    roles: string | null;
+    status: UserStatus;
+    isDeleted: boolean;
+  }>(db, userTable, {
     id: userId,
   });
-  if (userRow && isPrincipalBlocked(userRow.status)) return null;
+  if (userRow && isPrincipalRowBlocked(userRow)) return null;
   const globalRoles = parseRoles(userRow?.roles ?? null);
   return buildSessionRoles(globalRoles, parseRoles(membership.roles));
 }

package/packages/bundled-features/src/personal-access-tokens/screens.ts

@@ -35,6 +35,7 @@ const PAT_SCREEN_VISIBLE_WHEN = {
 export const patListScreen: ProjectionListScreenDefinition = {
   id: PAT_SCREEN_ID,
   type: "projectionList",
+  agent: { expose: false },
   visibleWhen: PAT_SCREEN_VISIBLE_WHEN,
   query: PatQueries.mine,
   // The `mine` handler honours `limit` only (no offset/total), so a pager would
@@ -118,6 +119,7 @@ export function createPatMintScreen(scopes: PatScopeConfig): SecretMintScreenDef
   return {
     id: PAT_MINT_SCREEN_ID,
     type: "secretMint",
+    agent: { expose: false },
     visibleWhen: PAT_SCREEN_VISIBLE_WHEN,
     handler: PatHandlers.create,
     fields: {

package/packages/bundled-features/src/readiness/feature.ts

@@ -11,21 +11,30 @@
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { statusQuery } from "./handlers/status.query.js";
 
-export const readinessFeature = defineFeature("readiness", (r) => {
-  r.describe(
-    "One-call tenant-onboarding probe: `readiness:query:status` rolls up every config key and secret declared `required: true` across all mounted features and reports which still lack a usable value for the calling tenant, plus a single `ready` boolean. Provider-features under an `r.extensionSelector`-declared extension point count only while their provider is the selected one — a tenant on the inmemory mail transport is not blocked by unset SMTP keys. Mount it (together with `config` and `secrets`) when an admin UI needs a settings checklist before the first mail-send or file-write; the per-concern lists stay available via `config:query:readiness` and `secrets:query:list`.",
-  );
-  r.uiHints({
-    displayLabel: "Readiness · Onboarding Probe",
-    category: "operations",
-    recommended: false,
-  });
-  r.requires({ features: ["config"] });
-  r.requires({ features: ["secrets"] });
+export function createReadinessFeature() {
+  return defineFeature(
+    "readiness",
+    (r) => {
+      r.describe(
+        "One-call tenant-onboarding probe: `readiness:query:status` rolls up every config key and secret declared `required: true` across all mounted features and reports which still lack a usable value for the calling tenant, plus a single `ready` boolean. Provider-features under an `r.extensionSelector`-declared extension point count only while their provider is the selected one — a tenant on the inmemory mail transport is not blocked by unset SMTP keys. Mount it (together with `config` and `secrets`) when an admin UI needs a settings checklist before the first mail-send or file-write; the per-concern lists stay available via `config:query:readiness` and `secrets:query:list`.",
+      );
+      r.uiHints({
+        displayLabel: "Readiness · Onboarding Probe",
+        category: "operations",
+        recommended: false,
+      });
+      r.requires({ features: ["config"] });
+      r.requires({ features: ["secrets"] });
+
+      const queries = {
+        status: r.queryHandler(statusQuery),
+      };
 
-  const queries = {
-    status: r.queryHandler(statusQuery),
-  };
+      return { queries };
+    },
+    { dedupeOptions: {} },
+  );
+}
 
-  return { queries };
-});
+/** @deprecated Use createReadinessFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const readinessFeature = createReadinessFeature();

package/packages/bundled-features/src/readiness/index.ts

@@ -1,3 +1,3 @@
 export { READINESS_FEATURE, ReadinessQueries } from "./constants.js";
-export { readinessFeature } from "./feature.js";
+export { createReadinessFeature, readinessFeature } from "./feature.js";
 export type { ReadinessMissingSecret } from "./handlers/status.query.js";

package/packages/bundled-features/src/secrets/db/queries/read.ts

@@ -1,5 +1,5 @@
-import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { StoredEnvelope } from "../../table.js";
 

package/packages/bundled-features/src/secrets/feature.ts

@@ -72,8 +72,13 @@ export { type StoredEnvelope, type StoredMetadata, tenantSecretsTable } from "./
 // FileProviderContext-Pfade (S3-Plugin im Worker) liefern dieselben
 // zwei Felder, also reicht die schmale ctx-shape — kein voller
 // HandlerContext-Import noetig.
+// Handler contexts carry the caller as ctx.user, provider contexts set _userId (takes precedence).
 export function requireSecretsContext(
-  ctx: { readonly secrets?: SecretsContext; readonly _userId?: string | undefined },
+  ctx: {
+    readonly secrets?: SecretsContext;
+    readonly _userId?: string | undefined;
+    readonly user?: { readonly id: string };
+  },
   handlerName: string,
 ): SecretsContext {
   if (!ctx.secrets) {
@@ -83,10 +88,10 @@ export function requireSecretsContext(
         "createSecretsContext({db, masterKeyProvider, registry}) via extraContext.secrets at boot.",
     });
   }
-  const userId = ctx._userId;
+  const userId = ctx._userId ?? ctx.user?.id;
   if (!userId) {
     throw new InternalError({
-      message: `[${handlerName}] ctx._userId missing — cannot audit secret reads without a caller identity.`,
+      message: `[${handlerName}] ctx._userId missing (and no ctx.user) — cannot audit secret reads without a caller identity.`,
     });
   }
   const withAudit = (raw: SecretsContext): SecretsContext => ({

package/packages/bundled-features/src/secrets/handlers/rotate.job.ts

@@ -17,11 +17,11 @@
 // that landed the row on the new kekVersion first surfaces here as a
 // version_conflict error (counted as "skipped", not "failed").
 
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createEventStoreExecutor,
   createTenantDb,
   type DbConnection,
+  selectMany,
   type TenantDb,
 } from "@cosmicdrift/kumiko-framework/db";
 import type { JobContext, SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
@@ -81,7 +81,7 @@ export async function rotateJob(
   function tdbFor(tenantId: TenantId): TenantDb {
     let existing = tdbCache.get(tenantId);
     if (!existing) {
-      existing = createTenantDb(db, tenantId, "system");
+      existing = createTenantDb({ db, tenantId, mode: "system" });
       tdbCache.set(tenantId, existing);
     }
     return existing;

package/packages/bundled-features/src/secrets/secrets-context.ts

@@ -12,12 +12,13 @@
 //           read logged") now sits on the events-table instead of a
 //           dedicated audit-table.
 
-import { fetchOne, transaction } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createEventStoreExecutor,
   createTenantDb,
   type DbConnection,
   type DbRunner,
+  fetchOne,
+  transaction,
 } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, type WriteErrorInfo } from "@cosmicdrift/kumiko-framework/errors";
@@ -205,7 +206,7 @@ function buildSecretsContext(
         tenantId,
         roles: SYSTEM_ROLES,
       };
-      const tdb = createTenantDb(db, tenantId, "system");
+      const tdb = createTenantDb({ db, tenantId, mode: "system" });
 
       const existing = await lookup(tenantId, key);
       const commonFields = {
@@ -270,7 +271,7 @@ function buildSecretsContext(
         tenantId,
         roles: SYSTEM_ROLES,
       };
-      const tdb = createTenantDb(db, tenantId, "system");
+      const tdb = createTenantDb({ db, tenantId, mode: "system" });
       const result = await executor.delete({ id: existing.id }, actor, tdb);
       return result.isSuccess;
     },

package/packages/bundled-features/src/sessions/db/queries/cleanup.ts

@@ -1,5 +1,5 @@
-import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/db";
 
 export async function deleteStaleSessionsBatch(
   db: DbConnection,

package/packages/bundled-features/src/sessions/handlers/detail.query.ts

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared/index.js";

package/packages/bundled-features/src/sessions/handlers/list.query.ts

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   definePagedQueryHandler,
@@ -11,7 +11,7 @@ import { userSessionTable } from "../schema/user-session.js";
 
 // `sort` arrives raw from the client's query string. selectMany's orderBy
 // has no column-existence check — an unrecognised field just gets
-// snake_cased and quoted as-is (bun-db/query.ts columnOf) — so this
+// snake_cased and quoted as-is (db/query.ts columnOf) — so this
 // allowlist is what stops a client sorting by ip/userAgent or any other
 // non-exposed column.
 const SORTABLE_COLUMNS = ["id", "userId", "createdAt", "expiresAt", "revokedAt"] as const;

package/packages/bundled-features/src/sessions/handlers/mine.query.ts

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { definePagedQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared/index.js";

package/packages/bundled-features/src/sessions/handlers/revoke-all-for-user.write.ts

@@ -1,5 +1,5 @@
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
-import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { updateMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineWriteHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { append } from "@cosmicdrift/kumiko-framework/event-store";

package/packages/bundled-features/src/sessions/handlers/revoke-all-others.write.ts

@@ -1,4 +1,4 @@
-import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { updateMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";

package/packages/bundled-features/src/sessions/handlers/revoke.write.ts

@@ -1,4 +1,4 @@
-import { fetchOne, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, updateMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";

package/packages/bundled-features/src/sessions/session-callbacks.ts

@@ -9,8 +9,8 @@ import type {
 
 export type { SessionMassRevoker } from "@cosmicdrift/kumiko-framework/api";
 
-import { fetchOne, insertOne, transaction, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { fetchOne, insertOne, transaction, updateMany } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { buildSessionRoles, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { append } from "@cosmicdrift/kumiko-framework/event-store";
@@ -18,7 +18,12 @@ import { generateId, parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { encryptForDirectWrite } from "../shared/index.js";
 import { tenantMembershipsTable } from "../tenant/index.js";
-import { isPrincipalBlocked, type UserStatus, userTable } from "../user/index.js";
+import {
+  isPrincipalBlocked,
+  isPrincipalRowBlocked,
+  type UserStatus,
+  userTable,
+} from "../user/index.js";
 import {
   DEFAULT_SESSION_EXPIRY_MS,
   LAST_SEEN_REFRESH_MS,
@@ -190,16 +195,18 @@ export function createSessionCallbacks(opts: SessionCallbacksOptions): SessionCa
       // missing row is a legitimate "no tenant roles" outcome. Both branches
       // return the bare "live" string (no re-derived roles) — the middleware
       // falls back to the JWT's frozen roles claim.
-      let user: { status: UserStatus; roles: string | null } | undefined;
+      let user: { status: UserStatus; isDeleted: boolean; roles: string | null } | undefined;
       try {
-        user = await fetchOne<{ status: UserStatus; roles: string | null }>(db, userTable, {
-          id: expectedUserId,
-        });
+        user = await fetchOne<{ status: UserStatus; isDeleted: boolean; roles: string | null }>(
+          db,
+          userTable,
+          { id: expectedUserId },
+        );
       } catch {
         return "live";
       }
       if (!user) return "live";
-      if (isPrincipalBlocked(user.status)) return "blocked";
+      if (isPrincipalRowBlocked(user)) return "blocked";
 
       // Same fail-open reasoning as the userTable lookup above — a transient
       // DB error on the membership read must not lock the user out. A

package/packages/bundled-features/src/sessions/testing.ts

@@ -19,7 +19,7 @@
 
 import type { AuthRoutesConfig, SessionCreator } from "@cosmicdrift/kumiko-framework/api";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
-import type { LateBoundHolder } from "@cosmicdrift/kumiko-framework/testing";
+import type { LateBoundHolder } from "@cosmicdrift/kumiko-testing/helpers";
 import type { SessionCallbacks, SessionMassRevoker } from "./session-callbacks.js";
 
 export type BoundSessionCallbacks = {

package/packages/bundled-features/src/tags/feature.ts

@@ -130,7 +130,7 @@ function registerTags(
   r.translations({ keys: TAGS_FEATURE_I18N });
 }
 
-export const tagsFeature = defineFeature(TAGS_FEATURE_NAME, (r) =>
+const defaultTagsFeature = defineFeature(TAGS_FEATURE_NAME, (r) =>
   registerTags(r, DEFAULT_TAG_ACCESS, undefined, undefined, undefined),
 );
 
@@ -183,7 +183,7 @@ function resolveAccess(opts: TagsFeatureOptions): AccessRule {
 // Backwards-compat / options wrapper. Without options returns the module-level
 // singleton (no rebuild). access/roles/toggleable/ownership build a fresh
 // feature-definition.
-export function createTagsFeature(opts: TagsFeatureOptions = {}): typeof tagsFeature {
+export function createTagsFeature(opts: TagsFeatureOptions = {}): typeof defaultTagsFeature {
   if (
     opts.access === undefined &&
     opts.roles === undefined &&
@@ -191,7 +191,7 @@ export function createTagsFeature(opts: TagsFeatureOptions = {}): typeof tagsFea
     opts.ownership === undefined &&
     opts.parents === undefined
   ) {
-    return tagsFeature;
+    return defaultTagsFeature;
   }
   if (opts.parents !== undefined && opts.parents.length === 0) {
     throw new Error(
@@ -207,3 +207,6 @@ export function createTagsFeature(opts: TagsFeatureOptions = {}): typeof tagsFea
     registerTags(r, access, opts.toggleable, opts.ownership, opts.parents),
   );
 }
+
+/** @deprecated Use createTagsFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const tagsFeature = createTagsFeature();

package/packages/bundled-features/src/template-resolver/api.ts

@@ -2,8 +2,8 @@
 // delivery and apps import types ONLY and take the implementation from
 // ctx.templateResolver at runtime.
 
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";

package/packages/bundled-features/src/template-resolver/changes.json

@@ -1,4 +1,29 @@
 [
+  {
+    "version": "0.367.0",
+    "type": "improvement",
+    "title": "Notifications can keep their mail template system-only",
+    "detail": "r.notification(name, { systemOnly: true }) marks the stored mail template as a platform text. Tenant admins no longer see it in the template overview, list or detail, and creating a tenant version (upsert-tenant, copy-locale, import-bundle, also a SystemAdmin writing for a tenant) is refused with access_denied and templateResolver.errors.systemOnlyTemplate. SystemAdmins edit the system template as before, and the mail renderer always uses it, even if a tenant row exists from before."
+  },
+  {
+    "version": "0.367.0",
+    "type": "fix",
+    "title": "Rich text placeholders no longer nest paragraphs",
+    "detail": "A richText placeholder alone in a paragraph compiles into a div that keeps the paragraph attributes, and one inside other text renders inline with line breaks instead of its own paragraphs. Mails and PDFs no longer contain <p><p>. richText and stepIs are now reserved template variable names, like the other renderer helpers.",
+    "migration": "A notification that declares a template variable called richText, stepIs or percent fails at boot; rename the variable."
+  },
+  {
+    "version": "0.367.0",
+    "type": "improvement",
+    "title": "Template bundles with a logo can be seeded",
+    "detail": "seedSystemTemplateBundle(db, bundle, { dispatcher }) now seeds bundles that carry resources such as a logo by running the import-bundle-system write on the given seed dispatcher. With ifExists \"skip\" (default) nothing is written when every locale row already exists; if only some exist, the whole bundle is imported again. Without a dispatcher such a bundle still fails with a message that names the missing option."
+  },
+  {
+    "version": "0.367.0",
+    "type": "improvement",
+    "title": "Template conditions with data-if and a percent variable type",
+    "detail": "A paragraph, heading or table row with data-if=\"name\" renders only when the variable has a value (0 counts as a value); inside a repeat row the name refers to the row field, on the repeat row itself to the root variable. The sanitizer keeps the attribute, and template validation reports a condition on an undeclared variable. New variable type percent (templateVariable.percent()) takes percentage points and renders locale-aware, 12 as \"12 %\" in German and \"12%\" in English; the preview uses its example value. The document designer has no toolbar control for conditions yet; the attribute survives editing."
+  },
   {
     "version": "0.365.0",
     "type": "breaking",